You've been heard. Response re: 4.9 and Encryption

kyoto kid

..David GB brings up a very valid point.

For example, in the 4.7 Update there was a change to the shader mixer that crippled the AoA effects cameras and Advanced Lights. For me these were tools I heavily depended on, due to the lighter render load compared with UE. It really put a crimp in my work as Iray was still an update away. Basically, what occurred was all of the Graphic Art cameras were broken, two of the Atmospheric Cameras were broken, and Flagging surfaces with SSS shaders when using the Advanced Lights no lonmger worked.

Just last week through the graces of one person here, scripts were released that fixed the Graphic Art Cameras and one of the effects of the Atmospheric Cameras (waiting on a script for the other). The issue with the Advanced Lights SSS flagging is unfortunately more complex, however, so was the thought of ever being able to transfer G2F skins to G3F until one enterprising PA at another store came up with a brilliant out of the box idea. So maybe there is a fix, but the means just haven't been discovered yet.

Were all Daz content and plugins encrypted, none of this would have been possible.

Petercat

SnowSultan said:

 

 

barbult said:

SpottedKitty said:

Petercat said:

Daz wanted a test, Daz got a test.

How many people downloaded it when it was marked as encrypted?

How many after the "encrypted" tag was removed?

There's your test.

Very much +1'd.

Mind you, it'll only be a valid test if the sales figures can differentiate between pre-fix and post-fix purchases. If they can't, or don't, then the whole thing is a badly misleading waste of time.

I don't think that will tell much of anything. It was only encrypted for a few hours. It will be free and unencrypted for a whole week, won't it? That timing alone should cause a much larger download of the unencrypted file.

Well, if there were 1000 "encrypted" sales in the first few hours before tapering off, and 2000 in the first few hours unencrypted, that would probably be an indication.

I didn't say that it would be a definitive test... but the information is there, however it got there. Might as well take a look, it might be useful.

IceDragonArt

dbdigital2 said:

Hellcat-1466942 said:

DAZ_Jon said:

People have brought both of them up before, but the first great example is Steam. Regardless of what people say, Steam is a DRM platform. It was originally done to track licenses and curb piracy on valves games, at the time of launch, half life 2, back in 2003. At the time it was largely reviled and pretty much everyone hated it because it was seen as an intrusion on privacy and way too different from normal methods of distribution which didn't have a phone home. Fast forward to 2007 and attitudes greatly changed and it finally was getting acceptance and a lot of other publishers interested in selling through them, largely because of a massive downturn in traditional methods of distribution in pc games. Now it is, generally, seen as being generally awesome because, where as it is a DRM platform, put out by people who as a while don't like DRM, so really put in lots of effort and years of work to get it the right balance of being DRM which is actually transparent or customer friendly. There are several well written articles and interviews with gaben back in the day that paint a pretty clear picture as to the actual history and motivation of the platform.

Second example is smart phones. No smart phone out there exists without DRM. It may not "benefit" the customer, but it is pretty much completely transparent and ties into a delivery mechanism where you can find, install, and use the app without having to have any technical background as to what the device is doing or where it is installing things. The DRM, especially in the case of the Apple store, could be said to be a benefit since it encourages developers to develop for it since they know their work is a little more protected and they get paid closer to what they deserve if it is successful than without it, which provides users with a wider selection of apps they might not otherwise have.

Now I'm not saying these compare exactly with this market, no two markets are alike. But it is two huge examples, in the excess of billions of dollars worth, where essentially DRM platforms were a benefit for customers. Yes, they might have been able to accomplish the same without DRM, but that is arguing hypotheticals versus what their platforms actually are.

Jon you mentioned DRM in smart phones.  Apparently you don't know them that well as you think.  Many MANY people have rooted or otherwise UNLOCKED them so they can BACKUP their apps or access other data that is otherwise locked to the phone.  Many of us won't buy a phone unless we can root/unlock it.  If we can't access our data it is not worth having the phone.  It is as simple as that.  For the people that don't, well they haven't had to change phones and woops that data can't be backedup or moved to the new phone easily.  The most popular app and reason for rooting?  Titanium Backup, or nandriod backup (better yet).  Again it is all to safeguard OUR data and the content WE PURCHASED.

With regard to STEAM, yes I have a steam account but I have only spent $1 there.  Why?  Because of the DRM.  All of my games there are freebies that were given as some sort of promotion.  I am one of the "steam leaches" I use a ton of bandwidth to download/install/reinstall games (as I don't have room for them all) but they don't get a dime out of me.  Another reason I don't use Steam much:, the games take too long to download and I don't have a easy way to uninstall/back them up for later.  Now GOG by contrast I have a TON of games from and they get money from me on a regular basis.  I dowload once, play the game, uninstall and then send the install file to my game storage drive.  I can reinstall and play the game in less than a minute.  Steam, well, most of them will take all day to get again, if not longer.  Steam has weeknend trials, which I am never able to try as my connection is too slow.  By the time I have downloaded the game, the trial is over. :/  Not their fault per say, but you can see why I don't like the system.  I am also not online with all of my systems, hence hard to play steam games on those systems (aka I don't which again limits the usefulness of the system).

This.  I have 2 steam games and probably 50 GOG games.  I don't buy steam games its ALWAYS a major hassle to get online, its very slow a lot, and god forbid I want to play a game but my internet is down

DAZ_Jon

millighost said:

Personally i have nothing against the encryption. As long as they are marking the releases accordingly, i can decide on an item-by-item basis if i would buy it or not. The same as for other items. Daz might just as well say "our sales team has found out, that pirates do copy bikinis less than other items, therefore we will release every other item in a bikini-version only". So less piracy, no harm done for anyone (except for the people, who irrationally refuse to render bikinis, who probably are the minority anyway).
What i find far more interesting is the fact, that DazConnect uses the actual user account name and password for its connect. That opens a lot of possibilities what can be done with DS4. I mean, i could hack DS4.8 and the best piece of data i could get out of it is its serial number. I could use that serial number to .... hm, only to run DS4, which is free anyway; how boring.
On the other hand if i can hack DS4.9 with (an enabled) DazConnect in it, in addition to the serial number, i will also get an account name and a password, that seems much more valueable. I could use that to sniff around the orders of the user, get a real name, posting spam and whatnot. I might even get lucky and the user has used the same password for other sites which i could try out.
There is also some kind of builtin browser within the smart content panel in DS4.9. I mean: it looks like a browser, but it has not that warning that pops up if the https-certification failed, although i did not try that. If i hacked into DS4.9 i would swap that out against my own version anyway. I wonder if someone could be that trusty to enter their credit card info into it. Probably no one, but it might be worth trying.
So basic question is: how hard is it to hack into DS4.9? Likely the easiest way is using the plugin-mechanism. Several third party plugins are already available. I guess not even Daz knows what these plugins do exactly. There is even a Reality plugin available on renderosity, completely out of Daz's control. So after the next time renderosity gets hacked, that plugin might not do the exactly the same as it did before renderosity got hacked. The user's best bet then is probably to completely remove their Daz account (and create a new one). And there is also a question connecting it to the encryption-problem: When i remove my account (which might be necessary in such a case), how do i get my licenses back?
In summary DazConnect might scare away some pirates, but creates a big security hole, which might attract a whole different kind of computer criminals, who are capable of doing much more damage if they succeed. Anyone can put some 1Mio Vicky-outfits on a czech server and nobody cares, but steal 100,000 user accounts and you will get mentioned on CNN.

 

Concerns about the security of this were brought up in the beta. Long story short, it is more secure than Install Manager, it is no less secure than Studio was previously. The in app shop can only go to our store (and part of paypal for that payment method if chosen) and no cross site scripting vulnerability. If you happened to get someone to install something malicious on your system, be it a plugin or other program, there are a ton of much easier and more vulnerable attack vectors than trying to tie into a free 3D application to get, at most, a username and password, with no option to spread it.

Given browsers, email clients, built in tools to your OS, messaging programs, etc., are such better and easier targets, the added "security risk" is so low, that only those that think it is prudent to build a faraday cage in their house level of paranoia would really worry about it.

lx_2807502

Petercat said:

SnowSultan said:

 

 

barbult said:

SpottedKitty said:

Petercat said:

Daz wanted a test, Daz got a test.

How many people downloaded it when it was marked as encrypted?

How many after the "encrypted" tag was removed?

There's your test.

Very much +1'd.

Mind you, it'll only be a valid test if the sales figures can differentiate between pre-fix and post-fix purchases. If they can't, or don't, then the whole thing is a badly misleading waste of time.

I don't think that will tell much of anything. It was only encrypted for a few hours. It will be free and unencrypted for a whole week, won't it? That timing alone should cause a much larger download of the unencrypted file.

Well, if there were 1000 "encrypted" sales in the first few hours before tapering off, and 2000 in the first few hours unencrypted, that would probably be an indication.

I didn't say that it would be a definitive test... but the information is there, however it got there. Might as well take a look, it might be useful.

The problem is that timezones exist and that's going to skew data on a one day test. (Just like looking at the data from the Blink Sales today won't mean much because a lot of us weren't around for them.)

 

DAZ_Jon said:

millighost said:

Personally i have nothing against the encryption. As long as they are marking the releases accordingly, i can decide on an item-by-item basis if i would buy it or not. The same as for other items. Daz might just as well say "our sales team has found out, that pirates do copy bikinis less than other items, therefore we will release every other item in a bikini-version only". So less piracy, no harm done for anyone (except for the people, who irrationally refuse to render bikinis, who probably are the minority anyway).
What i find far more interesting is the fact, that DazConnect uses the actual user account name and password for its connect. That opens a lot of possibilities what can be done with DS4. I mean, i could hack DS4.8 and the best piece of data i could get out of it is its serial number. I could use that serial number to .... hm, only to run DS4, which is free anyway; how boring.
On the other hand if i can hack DS4.9 with (an enabled) DazConnect in it, in addition to the serial number, i will also get an account name and a password, that seems much more valueable. I could use that to sniff around the orders of the user, get a real name, posting spam and whatnot. I might even get lucky and the user has used the same password for other sites which i could try out.
There is also some kind of builtin browser within the smart content panel in DS4.9. I mean: it looks like a browser, but it has not that warning that pops up if the https-certification failed, although i did not try that. If i hacked into DS4.9 i would swap that out against my own version anyway. I wonder if someone could be that trusty to enter their credit card info into it. Probably no one, but it might be worth trying.
So basic question is: how hard is it to hack into DS4.9? Likely the easiest way is using the plugin-mechanism. Several third party plugins are already available. I guess not even Daz knows what these plugins do exactly. There is even a Reality plugin available on renderosity, completely out of Daz's control. So after the next time renderosity gets hacked, that plugin might not do the exactly the same as it did before renderosity got hacked. The user's best bet then is probably to completely remove their Daz account (and create a new one). And there is also a question connecting it to the encryption-problem: When i remove my account (which might be necessary in such a case), how do i get my licenses back?
In summary DazConnect might scare away some pirates, but creates a big security hole, which might attract a whole different kind of computer criminals, who are capable of doing much more damage if they succeed. Anyone can put some 1Mio Vicky-outfits on a czech server and nobody cares, but steal 100,000 user accounts and you will get mentioned on CNN.

 

Concerns about the security of this were brought up in the beta. Long story short, it is more secure than Install Manager, it is no less secure than Studio was previously. The in app shop can only go to our store (and part of paypal for that payment method if chosen) and no cross site scripting vulnerability. If you happened to get someone to install something malicious on your system, be it a plugin or other program, there are a ton of much easier and more vulnerable attack vectors than trying to tie into a free 3D application to get, at most, a username and password, with no option to spread it.

Given browsers, email clients, built in tools to your OS, messaging programs, etc., are such better and easier targets, the added "security risk" is so low, that only those that think it is prudent to build a faraday cage in their house level of paranoia would really worry about it.

Good to know!

Alisa Uh-Lisa

SpottedKitty said:

Petercat said:

Daz wanted a test, Daz got a test.

How many people downloaded it when it was marked as encrypted?

How many after the "encrypted" tag was removed?

There's your test.

Very much +1'd.

Mind you, it'll only be a valid test if the sales figures can differentiate between pre-fix and post-fix purchases. If they can't, or don't, then the whole thing is a badly misleading waste of time.

It is not a valid test because there's no way to measure how many people put it in their carts and checked out before realizing it said it was encrypted.

shadowhawk1

frank0314 said:

mmitchell_houston said:

timmins.william said:

I don't think there's any real chance DRM will go away until a few months of sales data come in. At that point we'll all see if the customers actually care.

I agree with William. Time (and $$$) will tell if DRM is good, bad or it doesn't matter. Remember, although the anti-DRM group here in the Forums is VERY vocal, they may not represent a larger group of non-Forum users who either don't care or don't even know what DRM is.

I am pleased to know that at least some sort of "doomsday switch" scenario is in place. I'm not 100% reassured, but I'm about 85%. 

On the PLUS side, I'm happy to hear about the addition of an "Install" tab (or whatever it will be called). I've only played with DS 4.9 a little bit so far, and found the whole Connect thing to be a bit confusing and not as easy to use as the DIM.

We will never get a its good or its bad. Forum users only make up 8-10% of the customer base here at Daz. What everyone in the forums can dislike the majority who aren't vocal may like.

It is a shame that daz looks at a vocal few as a small group, most studies show that the small group is followed by a much larger group that isn't vocal and will sit back and say nothing for fear of backlash. Now I want to say that I in no way believe daz would do that but I am just pointing out what studies have shown. Unfortunately Franks answer probably holds more insight into daz's thoughts about us. We are being looked at as a NUMBER and not part of its CUSTOMER BASE. I am sure that I will get reminded that they are a business that has to make money to survive, and they are right daz is a business. But a business CANNOT survive if it continues to alienate its customer base. Since I am no longer a PC+ member I guess picking up my weekly and monthly freebies has come to an end, which just happens to be 99% of my purchases from daz in the last year plus. There are great vendors at other stores that have gotten my business and will continue to get it, despite others saying that quality suffers at other sites.  

WendyLuvsCatz

On another forum for a product I use with DRM

http://forum.reallusion.com/270751/DRM-TAKEOVER

I accept it as iClone always had it but they do now allow export with a pricetag at least, DAZ still does that for free.

However just sharing the difficulties it brings too.

I am not opposed to DRM as long as it does not impinge on my workflow, this I have been clear on, why take perfectly good duf files that work in Carrara 8.5 and Poser via D3D DSON loader and encrypt them so they do not, if you must at least offer a dearer export version if needed.

L'Adair

Midnight_stories said:

I'm interested do you use DAZ Studio to make a living, what the main purpose or is it just a hobby?

I don't make a living with DAZ Studio, or any 3D art. I started DS for the express purpose of doing book covers for my books. Unfortunately, I've spent far more time learning DS, (feel free to read that as "playing in DS,") than I have writing. I do seem to be getting back on track and my first published book is starting to show up with the new cover made in DS and Photoshop. The second book cover was finished first, and had a lot of influence on the first cover design.

Before I can publish the second book, actually a prequel to the first, I need to finish up rewrites and have it edited. (There are other books in progress. Different genres, different series. I changed gears when I accepted the reality my only published book was not going to do well until readers saw more books in the series.)

I have managed to set DS aside and open Scrivener instead, though still not as frequently as I should. That will change soon, with the first cover complete. I only need to do a few promo images with the new cover and I can ignore graphics altogether until the manuscript is at the editor's. Though "can" and "will" are not the same...

SpottedKitty

Alisa Uh-Lisa said:

SpottedKitty said:

Mind you, it'll only be a valid test if the sales figures can differentiate between pre-fix and post-fix purchases. If they can't, or don't, then the whole thing is a badly misleading waste of time.

It is not a valid test because there's no way to measure how many people put it in their carts and checked out before realizing it said it was encrypted.

A very good point. OK, take the "if" out of my statement above; this incident is pretty much useless as a "will we accept the new system" test.

argel1200

Midnight_stories said:

I'm interested do you use DAZ Studio to make a living, what the main purpose or is it just a hobby?

I have created a couple music album covers and some other compositions that include 3D artwork, so a bit of both though more on the hobby side.

Midnight_stories

L'Adair said:

Midnight_stories said:

I'm interested do you use DAZ Studio to make a living, what the main purpose or is it just a hobby?

I don't make a living with DAZ Studio, or any 3D art. I started DS for the express purpose of doing book covers for my books. Unfortunately, I've spent far more time learning DS, (feel free to read that as "playing in DS,") than I have writing. I do seem to be getting back on track and my first published book is starting to show up with the new cover made in DS and Photoshop. The second book cover was finished first, and had a lot of influence on the first cover design.

Before I can publish the second book, actually a prequel to the first, I need to finish up rewrites and have it edited. (There are other books in progress. Different genres, different series. I changed gears when I accepted the reality my only published book was not going to do well until readers saw more books in the series.)

I have managed to set DS aside and open Scrivener instead, though still not as frequently as I should. That will change soon, with the first cover complete. I only need to do a few promo images with the new cover and I can ignore graphics altogether until the manuscript is at the editor's. Though "can" and "will" are not the same...

 

L'Adair said:

Midnight_stories said:

I'm interested do you use DAZ Studio to make a living, what the main purpose or is it just a hobby?

I don't make a living with DAZ Studio, or any 3D art. I started DS for the express purpose of doing book covers for my books. Unfortunately, I've spent far more time learning DS, (feel free to read that as "playing in DS,") than I have writing. I do seem to be getting back on track and my first published book is starting to show up with the new cover made in DS and Photoshop. The second book cover was finished first, and had a lot of influence on the first cover design.

Before I can publish the second book, actually a prequel to the first, I need to finish up rewrites and have it edited. (There are other books in progress. Different genres, different series. I changed gears when I accepted the reality my only published book was not going to do well until readers saw more books in the series.)

I have managed to set DS aside and open Scrivener instead, though still not as frequently as I should. That will change soon, with the first cover complete. I only need to do a few promo images with the new cover and I can ignore graphics altogether until the manuscript is at the editor's. Though "can" and "will" are not the same...

Most of us vendors have no idea what you guys and gals do, and it seems you're professionals just like us. So I'm guessing you just want a hassle free software install with no troubles and use it weather you are on the net or not.

lx_2807502

Midnight_stories said:

I'm interested do you use DAZ Studio to make a living, what the main purpose or is it just a hobby?

I started DS as a way to have poseable figures for drawing (free Photoshop plugin really helps with this too) for character and outfit design concept art. Then I found out how accessible 3D content creation is these days, so now I use Blender to make the outfits using edited Daz figures as mannequins (bought the G3 mannequin SO fast the other week.) So I would say I use the main figures, the big morph packs, and a lot of Iray shaders.

The other 95% of my library is just "Ooh that's cool! Ooh that's cute! Ooh maybe one day I'll use this thing for a thing!" fun purchases.

Some sort of detailed PA market research questionnaire would be cool. Obviously not everyone can get the thing they want made but it'd be interesting if there was some sort of way that everyone could see a neatly collated view of what everyone wants to buy.

Midnight_stories

argel1200 said:

Midnight_stories said:

I'm interested do you use DAZ Studio to make a living, what the main purpose or is it just a hobby?

I have created a couple music album covers and some other compositions that include 3D artwork, so a bit of both though more on the hobby side.

Wow Album Covers that's impressive, I think we all start as hobby and one think leads to another I started with online comic and had to build my own stuff in poser to complete scene. Thanks for sharing !

kyoto kid

Midnight_stories said:

Most of us vendors have no idea what you guys and gals do, and it seems you're pofessionals just like us. So I'm guessing you just want a hassle free software install with no troubles and use it weather you are on the net or not.

...for myself it's developing characters and settings for illustrating a story I am currently working on (which will make use of both Daz and Carrara).

I dislike software that gets in the way of my work (which is why I don't use Blender) as well as prefer not to be online while working as I only have 11GB of free memory (after Windows), a 1st generation 2.4 GHz i7, and need every bit of both for rendering.

L'Adair

Midnight_stories said:

Most of us vendors have no idea what you guys and gals do, and it seems you're professionals just like us. So I'm guessing you just want a hassle free software install with no troubles and use it weather you are on the net or not.

That pretty much sums it up. I spent enough time getting proficient enough in DS to get output that matches the vision. I really don't want, or need, any more speed bumps when I'm trying to be creative. I want a program to assist me, not get in my way. (That's why, for example, I use Scrivener for writing rather than Word.)

Midnight_stories

kyoto kid said:

Midnight_stories said:

Most of us vendors have no idea what you guys and gals do, and it seems you're pofessionals just like us. So I'm guessing you just want a hassle free software install with no troubles and use it weather you are on the net or not.

...for myself it's developing characters and settings for illustrating a story I am currently working on (which will make use of both Daz and Carrara).

I dislike software that gets in the way of my work (which is why I don't use Blender) as well as prefer not to be online while working as I only have 11GB of free memory (after Windows), a 1st generation 2.4 GHz i7, and need every bit of both for rendering.

Well I hope DAZ is reading this and understanding what is important to you and why. Thanks for sharing !

acanthis

Petercat said:

Jack Tomalin said:

There, now everyone who wanted the Toll Booth can get it :)

Daz wanted a test, Daz got a test.

How many people downloaded it when it was marked as encrypted?

How many after the "encrypted" tag was removed?

There's your test.

Very true. This morning I checked it, saw that it had lost its DRM-only status, and so picked it up along with the Northern Terrace Street. (I took care to screen dump both product pages in the event that another mistake causes issues further down the line). I then downloaded the products as quickly as possible and backed up the files.

For me, this is what shopping at DAZ has become since DRM Day: Examine the products, do I want/need them? Are they DRM Only? If so, exclude from consideration. Of the remainder, wait at least one day for any mistakes that might result in their DRM status changing, then reconsider if still wanted/needed. If so, only then can they be bought (which does not guarantee that they will be - there are other stores with competing products).

I can't put a figure on it, but I'd say that the end result has been at least a 60% reduction in spend, if not more. The higher the ratio of DRM Only products, the lower that spend will become until, I assume, it hits zero.

[EDIT: btw that reduction in spend is not just due to DRM Only products, of which there have been very few so far, it's as a result of the revised purchasing process resulting from the existence of DRM]

a-sennov

kyoto kid said:

...so was the thought of ever being able to transfer G2F skins to G3F until one enterprising PA at another store came up with a brilliant out of the box idea. So maybe there is a fix, but the means just haven't been discovered yet.

Were all Daz content and plugins encrypted, none of this would have been possible.

Actually the idea of using geografts for this was in the very first threads about G3F (from Richard maybe ?) it just took so long to implement :) And as it's geografts it will work even if G3F is encrypted.

Fixing 3DL shaders (and they are in cameras too) is difficult because they're distributed in compiled form and that can be seen as another form of encryption :)

a-sennov

Midnight_stories said:

I'm interested do you use DAZ Studio to make a living, what the main purpose or is it just a hobby?

Hobby, a bit expencive (in terms of time, not money) :)

Once I had decided to become PA with my plugins but then quickly remembered what Mark Twain wrote about the matter and falled back to be happy hobbyist :)

Petercat

acanthis said:

Very true. This morning I checked it, saw that it had lost its DRM-only status, and so picked it up along with the Northern Terrace Street. (I took care to screen dump both product pages in the event that another mistake causes issues further down the line). I then downloaded the products as quickly as possible and backed up the files.

For me, this is what shopping at DAZ has become since DRM Day: Examine the products, do I want/need them? Are they DRM Only? If so, exclude from consideration. Of the remainder, wait at least one day for any mistakes that might result in their DRM status changing, then reconsider if still wanted/needed. If so, only then can they be bought (which does not guarantee that they will be - there are other stores with competing products).

I can't put a figure on it, but I'd say that the end result has been at least a 60% reduction in spend, if not more. The higher the ratio of DRM Only products, the lower that spend will become until, I assume, it hits zero.

[EDIT: btw that reduction in spend is not just due to DRM Only products, of which there have been very few so far, it's as a result of the revised purchasing process resulting from the existence of DRM]

I bought the Northern Terrace Street yesterday. I was suprised to notice that it got me the Gateway discounts, even though it wasn't listed as a featured new release. I guess the fact that it actually is a new release made it okay. But it was $3.49, which beats spending over $10.00 on something that I didn't want!

Havos

timmins.william said:

I canceled my PC+ membership and will be spending my dollars elsewhere once it expires.

 

It would take a lot for me to go to this extreme, I have so much back catalogue stuff I still want, I shall likely remain a member for a few years yet, no matter what. To me the PC+ represent such good value, particularly if you grab a years membership at some bargain price. I have never paid more than $35 for a full year (my first year was effectively free), that's about the same as rendo's prime club, and the perks offered by PC+ compared to prime are vastly better imho. Anyway it is a mute point for now, I am a paid up member until some time into 2017, and will remain one for at least 2-3 years beyond that. After that, if every new release is being encrypted, then I will reassess.

Will, I hope you will still post here, even if you shop elsewhere.

Havos

There has been some mention of 8-10% of buyers being forum posters. That may or may not be true, but remember that for every poster there are probably a lot more lurkers, that read the forums, but never actually post something. I had been reading these forums for more than a year before I posted anything, and I read the rendo/rnda forums as well, but I have never posted there. Naturally no one can say what the views of the lurkers are, in the same way as we can only guess the views of the buyers that never frequent the forums in any capacity, but at least the lurkers are fully aware of the DRM issues, and can make up their own minds as to their response to it.

bigh

thank you Daz for letting us download  Toll Booth using Dim

tl155180

Midnight_stories said:

kyoto kid said:

Midnight_stories said:

Most of us vendors have no idea what you guys and gals do, and it seems you're pofessionals just like us. So I'm guessing you just want a hassle free software install with no troubles and use it weather you are on the net or not.

...for myself it's developing characters and settings for illustrating a story I am currently working on (which will make use of both Daz and Carrara).

I dislike software that gets in the way of my work (which is why I don't use Blender) as well as prefer not to be online while working as I only have 11GB of free memory (after Windows), a 1st generation 2.4 GHz i7, and need every bit of both for rendering.

Well I hope DAZ is reading this and understanding what is important to you and why. Thanks for sharing !

Started as a hobbyist creating images and comics for my own amusement. Now I sell image sets under a pseudonym (so that no-one bothers me about it in rl) to top up my earnings. What bothers me most about 4.9 and Connect is this: Daz keeps telling me that they want to protect their products against hackers and piracy - yeah, I understand that. But I also want to protect myself against certain things.

For instance, and this is highly speculative, I understand that currently Connect does not give Daz the ability to upload any files from my PC. Thats "currently". They change their minds on things all the time, so nothing is set in stone - what happens if they decide in the future that its helpful to marketing for them to know exactly what everyone is producing with DS? I could potentially find that my images start mysteriously leaking out before I've even put them up for sale, or that "someone" has linked my real name to my pseudonym on the internet so that I start getting bombarded with work-related requests etc to my personal accounts. Obviously it wouldn't be Daz policy to do any of that, but can they 100% account for all their staff being 100% honest all of the time? Well they don't seem to think we are, so why should we think they are? So wheres my protection against future function-creep?

And before anyone cries "Paranoia" know that this is exactly how many movies, books and albums leak out in the first instance. Someone from the publishing company thinks "I'll just send this to my mate. No harm done there" then that mate sends it out to other people who then post it on the internet (like with one of Jamie Oliver's cookbooks).

I'm really not so bothered by the DRM thing as I am by this. If they funnelled DRM through DIM instead of requiring DS to have an online connection, then it wouldn't bother me so much.

I'm also not happy about the idea of having to accept the crazy runtime layouts that many PAs think appropriate when creating their products.

Edit: It seems to me that Connect erodes my protection in order to increase Daz's protection and thats not a trade-off I'm happy with.

linvanchene

some more thoughts that came to mind while reading trough this all...

argel1200 said:

 

As I mentioned earlier though, the more someone spends here, the more this DRM could impact them. And anyone considering a gamedev license should be reconsidering that (and anyone else purchasing 3D content for business purposes). And I would hope the majority of of customers in these categories are paying attention. I really do not get this DRM approach, unless DAZ wants to remain a hobby-only business.

Point 1:

How exactly is encryption in its current form affecting users with a game developers license?

All export options are exactly the same as before.

Am I missing something?

Side Note:

I do own a Commercial Game Developer License for DAZ Originals because I find this is a fair deal for users who want to create holographic or VR scenes and share them with others in the future. Progress in this area was slower than expected.

The whole point in the first phase will be to make some fun VR scenes and share them with friends. That is why I will not be able to use Game Developer licenses with limited use restrictions (1-5 projects) because sharing VR scenes over social networks is going to be the same as posting images in a hopefully not so far away future.

And of course shared VR scene files will also have some kind of encryption.

So far I can not think of any issues how encryption in its current form could affect a workflow to create scenes in the OctaneRender plugin for DAZ Studio and then exporting them to OR standalone to convert them to VR scenes.

Note 2: The current form of VR scenes are mostly 360 degree images you do not need a game license for that.

Nevertheless holographic light fields may distribute the scene in a 3d holographic form. That technology is still under construction. Maybe more news at GTC 2016...

Point 2:

In the past there were some kind of .duf files that were not readable with a textfile reader like notepad etc.

There may only have been very few posts that even mentioned this. The average users did not seem to have an issue with that.

Did you not notice because in fact you actually never even bothered trying to fix .duf manually by editing the code?

In all the time I only about three times edited a .duf file manually. In all the other times I wanted to edit a .duf I noticed that the .duf is encrypted, shrugged with the shoulders and moved on...

- - -

Point 3:

All 3d software have some proprietary file formats.

If you want to move 3D objects from one software to the other you allways have to use default export options like .obj, .abc etc.

IF DAZ wanted to make the encrypted files loadable in other software they could do that.

It does not matter if a DAZ Studio plugin for Cinema4D, 3DS Max or Houdini reads .duf files or encrypted .dsf

 

Side Note:

It does not matter what proprietary file format DAZ Studio is using as long as the export options are not messed with.

That is why I suggested to put the export options in the EULA so it is legally binding that those options are not going to be touched ever.

I do not buy 3D products at DAZ3D to just use them in DAZ Studio. But I do not think it necessary to just protest against encryption in general because there is a risk that the encryption is going to be used in order to completly isolate DAZ3D content for use in DAZ Studio only.

With all the doubts I still think they are reasonable enough to understand that the future is to make 3D content more compatible with other software and working together with other companies bringing the content to a lot of different plattforms.

- - -

Point 4:

Yes there are currently issues with activation on other machines, backups of encrypted products. But I trust that DAZ3D will sort trough them one after the other.

 

Point 5:

A lot of  users are worried how DAZ Connect will affect other stores.

Some users say that the file structure of other stores will keep being traditional in content directory style.

This will make searches and categorisation inefficient because two or three different file sorting solutions are present in DAZ Studio in different runtimes.

My personal solution is indeed to only buy content at DAZ3D exactly because that way I can just use the official category system and do not have to invest any time at all adding tags to 3rd party content. I know how to create products for other stores manually. I did that for 100s of products. But I simply am not anymore in the mood to keep doing that. In the future I will pay for products with metadata set up. Either the other stores can provide that or they cannot...

Nevertheless it does not have to be that way:

Why not invite other stores to distribute their products over DAZ connect with  categories set up and in encrypted form?

DAZ3D could provide this service for free or for a small percentage of the earnings.

The benefit would be that all stores who offer content for DAZ Studio can use the same category and search options.

- If DAZ3D keeps DAZ Connect as exclusive service they could attract new users who prefer a finished category system instead of having to manually moving around files and manually adding tags

- Nevertheless if DAZ3D grants access to the DAZ Connect distribution channel to other companies this could be a start in having all 3D asset stores working together in creating one categorisation system for all stores. DAZ3D could provide DAZ Connect as a central SERVICE to all other companies interested in sharing 3D content with their users.

- - -

Kerya

millighost said:

Personally i have nothing against the encryption. As long as they are marking the releases accordingly, i can decide on an item-by-item basis if i would buy it or not. The same as for other items. Daz might just as well say "our sales team has found out, that pirates do copy bikinis less than other items, therefore we will release every other item in a bikini-version only". So less piracy, no harm done for anyone (except for the people, who irrationally refuse to render bikinis, who probably are the minority anyway).
What i find far more interesting is the fact, that DazConnect uses the actual user account name and password for its connect. That opens a lot of possibilities what can be done with DS4. I mean, i could hack DS4.8 and the best piece of data i could get out of it is its serial number. I could use that serial number to .... hm, only to run DS4, which is free anyway; how boring.
On the other hand if i can hack DS4.9 with (an enabled) DazConnect in it, in addition to the serial number, i will also get an account name and a password, that seems much more valueable. I could use that to sniff around the orders of the user, get a real name, posting spam and whatnot. I might even get lucky and the user has used the same password for other sites which i could try out.
There is also some kind of builtin browser within the smart content panel in DS4.9. I mean: it looks like a browser, but it has not that warning that pops up if the https-certification failed, although i did not try that. If i hacked into DS4.9 i would swap that out against my own version anyway. I wonder if someone could be that trusty to enter their credit card info into it. Probably no one, but it might be worth trying.
So basic question is: how hard is it to hack into DS4.9? Likely the easiest way is using the plugin-mechanism. Several third party plugins are already available. I guess not even Daz knows what these plugins do exactly. There is even a Reality plugin available on renderosity, completely out of Daz's control. So after the next time renderosity gets hacked, that plugin might not do the exactly the same as it did before renderosity got hacked. The user's best bet then is probably to completely remove their Daz account (and create a new one). And there is also a question connecting it to the encryption-problem: When i remove my account (which might be necessary in such a case), how do i get my licenses back?
In summary DazConnect might scare away some pirates, but creates a big security hole, which might attract a whole different kind of computer criminals, who are capable of doing much more damage if they succeed. Anyone can put some 1Mio Vicky-outfits on a czech server and nobody cares, but steal 100,000 user accounts and you will get mentioned on CNN.

 

 

Thank you! You wrote that much better than I could!

I didn't download and install DS4.9 up to now - but I DO know that I will never let it use connect!

Kerya

DAZ_Jon said:

Concerns about the security of this were brought up in the beta. Long story short, it is more secure than Install Manager, it is no less secure than Studio was previously. The in app shop can only go to our store (and part of paypal for that payment method if chosen) and no cross site scripting vulnerability. If you happened to get someone to install something malicious on your system, be it a plugin or other program, there are a ton of much easier and more vulnerable attack vectors than trying to tie into a free 3D application to get, at most, a username and password, with no option to spread it.

Given browsers, email clients, built in tools to your OS, messaging programs, etc., are such better and easier targets, the added "security risk" is so low, that only those that think it is prudent to build a faraday cage in their house level of paranoia would really worry about it.

 

Thank you, now I know the level of my paranoia.

I always wanted to know how to measure it.

You learn something new every day.

nicstt

lx said:

barbult said:

SpottedKitty said:

Petercat said:

Daz wanted a test, Daz got a test.

How many people downloaded it when it was marked as encrypted?

How many after the "encrypted" tag was removed?

There's your test.

Very much +1'd.

Mind you, it'll only be a valid test if the sales figures can differentiate between pre-fix and post-fix purchases. If they can't, or don't, then the whole thing is a badly misleading waste of time.

I don't think that will tell much of anything. It was only encrypted for a few hours. It will be free and unencrypted for a whole week, won't it? That timing alone should cause a much larger download of the unencrypted file.

Agreed. It won't tell much when the error was found before US morning and then properly fixed around US afternoon of the item's first day online. 

I can't decide if I want the free toll booth because it now has a certain memorabilia value to it, or if I don't want it because it makes me sad.

I was getting it becuase it was free; but no immediate use.

Now, I don't care, I bought it, and then requrested a full refund on all items - it will remain unbought. It constitutes a reminder now of the whole debacle over DRM and I can do without that.

nicstt

DAZ_Jon said:

millighost said:

Personally i have nothing against the encryption. As long as they are marking the releases accordingly, i can decide on an item-by-item basis if i would buy it or not. The same as for other items. Daz might just as well say "our sales team has found out, that pirates do copy bikinis less than other items, therefore we will release every other item in a bikini-version only". So less piracy, no harm done for anyone (except for the people, who irrationally refuse to render bikinis, who probably are the minority anyway).
What i find far more interesting is the fact, that DazConnect uses the actual user account name and password for its connect. That opens a lot of possibilities what can be done with DS4. I mean, i could hack DS4.8 and the best piece of data i could get out of it is its serial number. I could use that serial number to .... hm, only to run DS4, which is free anyway; how boring.
On the other hand if i can hack DS4.9 with (an enabled) DazConnect in it, in addition to the serial number, i will also get an account name and a password, that seems much more valueable. I could use that to sniff around the orders of the user, get a real name, posting spam and whatnot. I might even get lucky and the user has used the same password for other sites which i could try out.
There is also some kind of builtin browser within the smart content panel in DS4.9. I mean: it looks like a browser, but it has not that warning that pops up if the https-certification failed, although i did not try that. If i hacked into DS4.9 i would swap that out against my own version anyway. I wonder if someone could be that trusty to enter their credit card info into it. Probably no one, but it might be worth trying.
So basic question is: how hard is it to hack into DS4.9? Likely the easiest way is using the plugin-mechanism. Several third party plugins are already available. I guess not even Daz knows what these plugins do exactly. There is even a Reality plugin available on renderosity, completely out of Daz's control. So after the next time renderosity gets hacked, that plugin might not do the exactly the same as it did before renderosity got hacked. The user's best bet then is probably to completely remove their Daz account (and create a new one). And there is also a question connecting it to the encryption-problem: When i remove my account (which might be necessary in such a case), how do i get my licenses back?
In summary DazConnect might scare away some pirates, but creates a big security hole, which might attract a whole different kind of computer criminals, who are capable of doing much more damage if they succeed. Anyone can put some 1Mio Vicky-outfits on a czech server and nobody cares, but steal 100,000 user accounts and you will get mentioned on CNN.

 

Concerns about the security of this were brought up in the beta. Long story short, it is more secure than Install Manager, it is no less secure than Studio was previously. The in app shop can only go to our store (and part of paypal for that payment method if chosen) and no cross site scripting vulnerability. If you happened to get someone to install something malicious on your system, be it a plugin or other program, there are a ton of much easier and more vulnerable attack vectors than trying to tie into a free 3D application to get, at most, a username and password, with no option to spread it.

Given browsers, email clients, built in tools to your OS, messaging programs, etc., are such better and easier targets, the added "security risk" is so low, that only those that think it is prudent to build a faraday cage in their house level of paranoia would really worry about it.

When comparing the comparative risks of DIM and Connect.

1 DIM only on for a short time from my perspective.

2 Connect is on (or would be if I used it) all the time 4.9 is being used; and I've no idea how vulnerable it is even with the functionality being blocked.#

That's the think about vulnerabilities, they allow criminals (and possibly others?) to exploit a vulnerability.

This is another reason I don't like 4.9, although I can monitor my internet connection using certain tools, I don't know if I'm missing something. That Faraday cage is looking really good about now. ... off to repair my tin hat.

 

linvanchene

Point 4:

Yes there are currently issues with activation on other machines, backups of encrypted products. But I trust that DAZ3D will sort trough them one after the other.

Trust is a two-way process. We're not trusted. And we've seen statements by Daz change quickly.

So no, I am now dubious about such matters.