You've been heard. Response re: 4.9 and Encryption

1282931333461

Comments

  • a-sennova-sennov Posts: 331
    ..all 3D asset stores working together in creating one categorisation system for all stores. DAZ3D could provide DAZ Connect as a central SERVICE to all other companies interested in sharing 3D content with their users.

    You don't need Connect for this - just standardized format for metadata, but this didn't happen as for now and not likely to be in the future.

  • a-sennova-sennov Posts: 331
    In the past there were some kind of .duf files that were not readable with a textfile reader like notepad etc.

    There may only have been very few posts that even mentioned this. The average users did not seem to have an issue with that.

    Did you not notice because in fact you actually never even bothered trying to fix .duf manually by editing the code?

    In all the time I only about three times edited a .duf file manually. In all the other times I wanted to edit a .duf I noticed that the .duf is encrypted, shrugged with the shoulders and moved on...

    I didn't mention it because it's the past. Those were .daz files, they were binary and also had encryption option but I usually hacked .cr2 and .pz3 that time :)

    And I doubt You want to be merely "average user". :)

  • For me the toll booth is a pass for several reasons

    1 encrypted (even though it is free, so minor issue, if I had to pay money for it, then major issue if encrypted)

    2 have zero use for a toll booth  ..that was the killer

     

  • HavosHavos Posts: 5,573

    For me the toll booth is a pass for several reasons

    1 encrypted (even though it is free, so minor issue, if I had to pay money for it, then major issue if encrypted)

    2 have zero use for a toll booth  ..that was the killer

     

    The toll booth is no longer encrypted, and from what we have been told, never should have been. However none of that helps your reason 2!

  • fixmypcmikefixmypcmike Posts: 19,682
    nicstt said:
    DAZ_Jon said:

    Personally i have nothing against the encryption. As long as they are marking the releases accordingly, i can decide on an item-by-item basis if i would buy it or not. The same as for other items. Daz might just as well say "our sales team has found out, that pirates do copy bikinis less than other items, therefore we will release every other item in a bikini-version only". So less piracy, no harm done for anyone (except for the people, who irrationally refuse to render bikinis, who probably are the minority anyway).
    What i find far more interesting is the fact, that DazConnect uses the actual user account name and password for its connect. That opens a lot of possibilities what can be done with DS4. I mean, i could hack DS4.8 and the best piece of data i could get out of it is its serial number. I could use that serial number to .... hm, only to run DS4, which is free anyway; how boring.
    On the other hand if i can hack DS4.9 with (an enabled) DazConnect in it, in addition to the serial number, i will also get an account name and a password, that seems much more valueable. I could use that to sniff around the orders of the user, get a real name, posting spam and whatnot. I might even get lucky and the user has used the same password for other sites which i could try out.
    There is also some kind of builtin browser within the smart content panel in DS4.9. I mean: it looks like a browser, but it has not that warning that pops up if the https-certification failed, although i did not try that. If i hacked into DS4.9 i would swap that out against my own version anyway. I wonder if someone could be that trusty to enter their credit card info into it. Probably no one, but it might be worth trying.
    So basic question is: how hard is it to hack into DS4.9? Likely the easiest way is using the plugin-mechanism. Several third party plugins are already available. I guess not even Daz knows what these plugins do exactly. There is even a Reality plugin available on renderosity, completely out of Daz's control. So after the next time renderosity gets hacked, that plugin might not do the exactly the same as it did before renderosity got hacked. The user's best bet then is probably to completely remove their Daz account (and create a new one). And there is also a question connecting it to the encryption-problem: When i remove my account (which might be necessary in such a case), how do i get my licenses back?
    In summary DazConnect might scare away some pirates, but creates a big security hole, which might attract a whole different kind of computer criminals, who are capable of doing much more damage if they succeed. Anyone can put some 1Mio Vicky-outfits on a czech server and nobody cares, but steal 100,000 user accounts and you will get mentioned on CNN.

     

    Concerns about the security of this were brought up in the beta. Long story short, it is more secure than Install Manager, it is no less secure than Studio was previously. The in app shop can only go to our store (and part of paypal for that payment method if chosen) and no cross site scripting vulnerability. If you happened to get someone to install something malicious on your system, be it a plugin or other program, there are a ton of much easier and more vulnerable attack vectors than trying to tie into a free 3D application to get, at most, a username and password, with no option to spread it.

    Given browsers, email clients, built in tools to your OS, messaging programs, etc., are such better and easier targets, the added "security risk" is so low, that only those that think it is prudent to build a faraday cage in their house level of paranoia would really worry about it.

    When comparing the comparative risks of DIM and Connect.

    1 DIM only on for a short time from my perspective.

    2 Connect is on (or would be if I used it) all the time 4.9 is being used; and I've no idea how vulnerable it is even with the functionality being blocked.#

    That's the think about vulnerabilities, they allow criminals (and possibly others?) to exploit a vulnerability.

    This is another reason I don't like 4.9, although I can monitor my internet connection using certain tools, I don't know if I'm missing something. That Faraday cage is looking really good about now. cheeky ... off to repair my tin hat.

    This is incorrrect.  Connect does not log in automatically, it's only on when you choose to login and you can log out at any time with one click.

  • nicsttnicstt Posts: 11,715
    nicstt said:
    DAZ_Jon said:

    Personally i have nothing against the encryption. As long as they are marking the releases accordingly, i can decide on an item-by-item basis if i would buy it or not. The same as for other items. Daz might just as well say "our sales team has found out, that pirates do copy bikinis less than other items, therefore we will release every other item in a bikini-version only". So less piracy, no harm done for anyone (except for the people, who irrationally refuse to render bikinis, who probably are the minority anyway).
    What i find far more interesting is the fact, that DazConnect uses the actual user account name and password for its connect. That opens a lot of possibilities what can be done with DS4. I mean, i could hack DS4.8 and the best piece of data i could get out of it is its serial number. I could use that serial number to .... hm, only to run DS4, which is free anyway; how boring.
    On the other hand if i can hack DS4.9 with (an enabled) DazConnect in it, in addition to the serial number, i will also get an account name and a password, that seems much more valueable. I could use that to sniff around the orders of the user, get a real name, posting spam and whatnot. I might even get lucky and the user has used the same password for other sites which i could try out.
    There is also some kind of builtin browser within the smart content panel in DS4.9. I mean: it looks like a browser, but it has not that warning that pops up if the https-certification failed, although i did not try that. If i hacked into DS4.9 i would swap that out against my own version anyway. I wonder if someone could be that trusty to enter their credit card info into it. Probably no one, but it might be worth trying.
    So basic question is: how hard is it to hack into DS4.9? Likely the easiest way is using the plugin-mechanism. Several third party plugins are already available. I guess not even Daz knows what these plugins do exactly. There is even a Reality plugin available on renderosity, completely out of Daz's control. So after the next time renderosity gets hacked, that plugin might not do the exactly the same as it did before renderosity got hacked. The user's best bet then is probably to completely remove their Daz account (and create a new one). And there is also a question connecting it to the encryption-problem: When i remove my account (which might be necessary in such a case), how do i get my licenses back?
    In summary DazConnect might scare away some pirates, but creates a big security hole, which might attract a whole different kind of computer criminals, who are capable of doing much more damage if they succeed. Anyone can put some 1Mio Vicky-outfits on a czech server and nobody cares, but steal 100,000 user accounts and you will get mentioned on CNN.

     

    Concerns about the security of this were brought up in the beta. Long story short, it is more secure than Install Manager, it is no less secure than Studio was previously. The in app shop can only go to our store (and part of paypal for that payment method if chosen) and no cross site scripting vulnerability. If you happened to get someone to install something malicious on your system, be it a plugin or other program, there are a ton of much easier and more vulnerable attack vectors than trying to tie into a free 3D application to get, at most, a username and password, with no option to spread it.

    Given browsers, email clients, built in tools to your OS, messaging programs, etc., are such better and easier targets, the added "security risk" is so low, that only those that think it is prudent to build a faraday cage in their house level of paranoia would really worry about it.

    When comparing the comparative risks of DIM and Connect.

    1 DIM only on for a short time from my perspective.

    2 Connect is on (or would be if I used it) all the time 4.9 is being used; and I've no idea how vulnerable it is even with the functionality being blocked.#

    That's the think about vulnerabilities, they allow criminals (and possibly others?) to exploit a vulnerability.

    This is another reason I don't like 4.9, although I can monitor my internet connection using certain tools, I don't know if I'm missing something. That Faraday cage is looking really good about now. cheeky ... off to repair my tin hat.

    This is incorrrect.  Connect does not log in automatically, it's only on when you choose to login and you can log out at any time with one click.

    I realise that. It does in some way perform a hand-shake of some kind, otherwise it couldn't then log me in. But I know I'm paranoid, so realise some of what occurs to me is, lets say, out-there.

  • fixmypcmikefixmypcmike Posts: 19,682
    nicstt said:
    nicstt said:
    DAZ_Jon said:

    Personally i have nothing against the encryption. As long as they are marking the releases accordingly, i can decide on an item-by-item basis if i would buy it or not. The same as for other items. Daz might just as well say "our sales team has found out, that pirates do copy bikinis less than other items, therefore we will release every other item in a bikini-version only". So less piracy, no harm done for anyone (except for the people, who irrationally refuse to render bikinis, who probably are the minority anyway).
    What i find far more interesting is the fact, that DazConnect uses the actual user account name and password for its connect. That opens a lot of possibilities what can be done with DS4. I mean, i could hack DS4.8 and the best piece of data i could get out of it is its serial number. I could use that serial number to .... hm, only to run DS4, which is free anyway; how boring.
    On the other hand if i can hack DS4.9 with (an enabled) DazConnect in it, in addition to the serial number, i will also get an account name and a password, that seems much more valueable. I could use that to sniff around the orders of the user, get a real name, posting spam and whatnot. I might even get lucky and the user has used the same password for other sites which i could try out.
    There is also some kind of builtin browser within the smart content panel in DS4.9. I mean: it looks like a browser, but it has not that warning that pops up if the https-certification failed, although i did not try that. If i hacked into DS4.9 i would swap that out against my own version anyway. I wonder if someone could be that trusty to enter their credit card info into it. Probably no one, but it might be worth trying.
    So basic question is: how hard is it to hack into DS4.9? Likely the easiest way is using the plugin-mechanism. Several third party plugins are already available. I guess not even Daz knows what these plugins do exactly. There is even a Reality plugin available on renderosity, completely out of Daz's control. So after the next time renderosity gets hacked, that plugin might not do the exactly the same as it did before renderosity got hacked. The user's best bet then is probably to completely remove their Daz account (and create a new one). And there is also a question connecting it to the encryption-problem: When i remove my account (which might be necessary in such a case), how do i get my licenses back?
    In summary DazConnect might scare away some pirates, but creates a big security hole, which might attract a whole different kind of computer criminals, who are capable of doing much more damage if they succeed. Anyone can put some 1Mio Vicky-outfits on a czech server and nobody cares, but steal 100,000 user accounts and you will get mentioned on CNN.

     

    Concerns about the security of this were brought up in the beta. Long story short, it is more secure than Install Manager, it is no less secure than Studio was previously. The in app shop can only go to our store (and part of paypal for that payment method if chosen) and no cross site scripting vulnerability. If you happened to get someone to install something malicious on your system, be it a plugin or other program, there are a ton of much easier and more vulnerable attack vectors than trying to tie into a free 3D application to get, at most, a username and password, with no option to spread it.

    Given browsers, email clients, built in tools to your OS, messaging programs, etc., are such better and easier targets, the added "security risk" is so low, that only those that think it is prudent to build a faraday cage in their house level of paranoia would really worry about it.

    When comparing the comparative risks of DIM and Connect.

    1 DIM only on for a short time from my perspective.

    2 Connect is on (or would be if I used it) all the time 4.9 is being used; and I've no idea how vulnerable it is even with the functionality being blocked.#

    That's the think about vulnerabilities, they allow criminals (and possibly others?) to exploit a vulnerability.

    This is another reason I don't like 4.9, although I can monitor my internet connection using certain tools, I don't know if I'm missing something. That Faraday cage is looking really good about now. cheeky ... off to repair my tin hat.

    This is incorrrect.  Connect does not log in automatically, it's only on when you choose to login and you can log out at any time with one click.

    I realise that. It does in some way perform a hand-shake of some kind, otherwise it couldn't then log me in. But I know I'm paranoid, so realise some of what occurs to me is, lets say, out-there.

    As does DIM, or logging in with a browser.

  • linvanchenelinvanchene Posts: 1,386
    edited February 2016
    a-sennov said:
    ..all 3D asset stores working together in creating one categorisation system for all stores. DAZ3D could provide DAZ Connect as a central SERVICE to all other companies interested in sharing 3D content with their users.

    You don't need Connect for this - just standardized format for metadata, but this didn't happen as for now and not likely to be in the future.

    DAZ connect is the distribution system with the benefit that it shows both installed and uninstalled products.

    Metadata includes just the categories. Products of other stores are currently not uploaded on the DAZ connect server so you will not see uninstalled products from other stores in DAZ Studio "all" or "available" tabs.

    Example:

    You open up DAZ Studio and browse to the category wardrobe/shirts in the Smart Content Tab.

    Currently with DAZ Studio 4.9 you can see all installed and uninstalled products you purchased at DAZ3D.

    You can also see those products with metadata from other stores that are installed.

    Now imagine in the same spot all products you purchased in other stores that include shirts would show up in the same place no matter if they are installed or not.

    Currently you cannot right click uninstalled products of others stores directly in the DAZ Studio Smart content tab and download and install them because the other stores have not uploaded any products to the DAZ Connect Servers.

    - - -

    Just because something did not happen in the past does not mean that it must stay the same.

    Allready in the first metadata products of 2011 there was the option to add a store identifier to the metadata.

    And some vendors in other stores  did make an effort of adding categories to their products.

    Therefore it could very well be that some 3rd party stores or vendors might actually be interested to upload their products on the DAZ connect server so their customers could download them directly inside DAZ Studio as well.

    But probably it is a bit too early in the development cycle now and all the issues have to be sorted out before involving even more people...

    Anyway the reason why I brought this up is that I was under the impression that it does not have to be "X VS Y" but they could all find a way to work together if that makes sense for them from a business perspective.

    Post edited by linvanchene on
  • a-sennov said:
    In the past there were some kind of .duf files that were not readable with a textfile reader like notepad etc.

    There may only have been very few posts that even mentioned this. The average users did not seem to have an issue with that.

    Did you not notice because in fact you actually never even bothered trying to fix .duf manually by editing the code?

    In all the time I only about three times edited a .duf file manually. In all the other times I wanted to edit a .duf I noticed that the .duf is encrypted, shrugged with the shoulders and moved on...

    I didn't mention it because it's the past. Those were .daz files, they were binary and also had encryption option but I usually hacked .cr2 and .pz3 that time :)

    And I doubt You want to be merely "average user". :)

    I wonder if those files aren't so much encrypted as compressed. And thus can be uncompressed. I do note that I'm not able to use products with .daz files that have been installed through connect. Which given that they're useful products from some notable PAs kinda bothers me, but I put a ticket in on that. Also I should be able to save the assets out in nice unencrypted .dufs I believe. If I can make them open. I think when I poked at them for the sake of being able to add some of my troubleshooting to the ticket, I was able to get them to open by setting the product folder as a base runtime for DAZ Studio content in the content pane. But as this affects several products, that's not an ideal solution. I suppose if I just copied them to my normal library it'd likely find them. It just seems whatever Connect is using to let products find their resources is not working for these particular products with that filetype. 

    But the point is compression is not the same thing. While a compressed file can be encrypted, and isn't readable plaintext, an non-encrypted compressed file can be uncompressed and read as normal. Just having a proprietary format isn't the same as having an encryption locked one. For a good example, I'll point to gaming. Most games use files that are specific to that game. But they're not encrypted to a specific user. So tools made to modify game files can be worked on by multiple people, who can puzzle out how to edit the files, and make mods that will work for others. And some games do encrypt their files or use compression methods not commonly available in order to prevent modification. The difference is, games are presented as something we're meant to use in the form the creators intended. Do you really want your 3d artistic content to be like that? People do wonderful creative things with content all the time through a variety of methods, including direct editing of the files. Locking the files to encrypted formats is pretty much demanding that we only color within the lines with the products.

    To the original post quoted: Just because you don't edit .duf files often doesn't mean there aren't users who do. And I'm sure if they encountered the compressed/binary ones, they saved them in a non-binary uncompressed form and went to editing. 

    And you shouldn't try to claim that all export options are the same when Daz has outright stated that Cararra's normal ability to read .dufs and the DSON plugin for Poser users do not work with encrypted content at this time. That's two options down, and the others are stated as being 'less than' what the product was originally. Which is how they had been, but now with less chance some bright person could write a plugin or converter to handle carrying over more functionality into other software.

    No way around it, DRM encryption cripples the products it's used on in order to lock them down. Maybe you don't need the lost functionality. Maybe most users don't. But there are people who relied on it to do their work with this software, and there's always the possibility of others running into a situation where such access could be useful only to have it denied.

  • a-sennova-sennov Posts: 331
    DAZ connect is the distribution system with the benefit that it shows both installed and uninstalled products.
    ...

    Anyway the reason why I brought this up is that I was under the impression that it does not have to be "X VS Y" but they could all find a way to work together if that makes sense for them from a business perspective.

    It's not just a distribution system or installation managment system - money is involved and in these circumstances I see it's very unlikely that stores will come to agreement. Look, they didn't produce such simple thing as common XML format for metadata in all those years and common use of Connect will require agreements on profit distribution, advertizing, how to deel with PAs who sell in different stores etc. Years of existence of DIM didn't convince any other store to support it.

    And to my taste applications must do what they do best and not to try be 'jack of many trades'.

  • nicsttnicstt Posts: 11,715
    nicstt said:
    nicstt said:
    DAZ_Jon said:

    Personally i have nothing against the encryption. As long as they are marking the releases accordingly, i can decide on an item-by-item basis if i would buy it or not. The same as for other items. Daz might just as well say "our sales team has found out, that pirates do copy bikinis less than other items, therefore we will release every other item in a bikini-version only". So less piracy, no harm done for anyone (except for the people, who irrationally refuse to render bikinis, who probably are the minority anyway).
    What i find far more interesting is the fact, that DazConnect uses the actual user account name and password for its connect. That opens a lot of possibilities what can be done with DS4. I mean, i could hack DS4.8 and the best piece of data i could get out of it is its serial number. I could use that serial number to .... hm, only to run DS4, which is free anyway; how boring.
    On the other hand if i can hack DS4.9 with (an enabled) DazConnect in it, in addition to the serial number, i will also get an account name and a password, that seems much more valueable. I could use that to sniff around the orders of the user, get a real name, posting spam and whatnot. I might even get lucky and the user has used the same password for other sites which i could try out.
    There is also some kind of builtin browser within the smart content panel in DS4.9. I mean: it looks like a browser, but it has not that warning that pops up if the https-certification failed, although i did not try that. If i hacked into DS4.9 i would swap that out against my own version anyway. I wonder if someone could be that trusty to enter their credit card info into it. Probably no one, but it might be worth trying.
    So basic question is: how hard is it to hack into DS4.9? Likely the easiest way is using the plugin-mechanism. Several third party plugins are already available. I guess not even Daz knows what these plugins do exactly. There is even a Reality plugin available on renderosity, completely out of Daz's control. So after the next time renderosity gets hacked, that plugin might not do the exactly the same as it did before renderosity got hacked. The user's best bet then is probably to completely remove their Daz account (and create a new one). And there is also a question connecting it to the encryption-problem: When i remove my account (which might be necessary in such a case), how do i get my licenses back?
    In summary DazConnect might scare away some pirates, but creates a big security hole, which might attract a whole different kind of computer criminals, who are capable of doing much more damage if they succeed. Anyone can put some 1Mio Vicky-outfits on a czech server and nobody cares, but steal 100,000 user accounts and you will get mentioned on CNN.

     

    Concerns about the security of this were brought up in the beta. Long story short, it is more secure than Install Manager, it is no less secure than Studio was previously. The in app shop can only go to our store (and part of paypal for that payment method if chosen) and no cross site scripting vulnerability. If you happened to get someone to install something malicious on your system, be it a plugin or other program, there are a ton of much easier and more vulnerable attack vectors than trying to tie into a free 3D application to get, at most, a username and password, with no option to spread it.

    Given browsers, email clients, built in tools to your OS, messaging programs, etc., are such better and easier targets, the added "security risk" is so low, that only those that think it is prudent to build a faraday cage in their house level of paranoia would really worry about it.

    When comparing the comparative risks of DIM and Connect.

    1 DIM only on for a short time from my perspective.

    2 Connect is on (or would be if I used it) all the time 4.9 is being used; and I've no idea how vulnerable it is even with the functionality being blocked.#

    That's the think about vulnerabilities, they allow criminals (and possibly others?) to exploit a vulnerability.

    This is another reason I don't like 4.9, although I can monitor my internet connection using certain tools, I don't know if I'm missing something. That Faraday cage is looking really good about now. cheeky ... off to repair my tin hat.

    This is incorrrect.  Connect does not log in automatically, it's only on when you choose to login and you can log out at any time with one click.

    I realise that. It does in some way perform a hand-shake of some kind, otherwise it couldn't then log me in. But I know I'm paranoid, so realise some of what occurs to me is, lets say, out-there.

    As does DIM, or logging in with a browser.

    Of course, but I use DIM, then close it down; it's on for about five minutes as I have a fast connection. My browser, well that's a whole other story. I stick with firefox as I trust it more - the source code for example gets peer-reviewed. If I could get Daz working properly in Linux, I wouldn't be using Windows either - especially Windows 10; have you seen the EULA? But not related to this thread. I'm tech-savvy, which probably contributes to my paranoia. :)

  • nicstt said:
    nicstt said:
    nicstt said:
    DAZ_Jon said:

    Personally i have nothing against the encryption. As long as they are marking the releases accordingly, i can decide on an item-by-item basis if i would buy it or not. The same as for other items. Daz might just as well say "our sales team has found out, that pirates do copy bikinis less than other items, therefore we will release every other item in a bikini-version only". So less piracy, no harm done for anyone (except for the people, who irrationally refuse to render bikinis, who probably are the minority anyway).
    What i find far more interesting is the fact, that DazConnect uses the actual user account name and password for its connect. That opens a lot of possibilities what can be done with DS4. I mean, i could hack DS4.8 and the best piece of data i could get out of it is its serial number. I could use that serial number to .... hm, only to run DS4, which is free anyway; how boring.
    On the other hand if i can hack DS4.9 with (an enabled) DazConnect in it, in addition to the serial number, i will also get an account name and a password, that seems much more valueable. I could use that to sniff around the orders of the user, get a real name, posting spam and whatnot. I might even get lucky and the user has used the same password for other sites which i could try out.
    There is also some kind of builtin browser within the smart content panel in DS4.9. I mean: it looks like a browser, but it has not that warning that pops up if the https-certification failed, although i did not try that. If i hacked into DS4.9 i would swap that out against my own version anyway. I wonder if someone could be that trusty to enter their credit card info into it. Probably no one, but it might be worth trying.
    So basic question is: how hard is it to hack into DS4.9? Likely the easiest way is using the plugin-mechanism. Several third party plugins are already available. I guess not even Daz knows what these plugins do exactly. There is even a Reality plugin available on renderosity, completely out of Daz's control. So after the next time renderosity gets hacked, that plugin might not do the exactly the same as it did before renderosity got hacked. The user's best bet then is probably to completely remove their Daz account (and create a new one). And there is also a question connecting it to the encryption-problem: When i remove my account (which might be necessary in such a case), how do i get my licenses back?
    In summary DazConnect might scare away some pirates, but creates a big security hole, which might attract a whole different kind of computer criminals, who are capable of doing much more damage if they succeed. Anyone can put some 1Mio Vicky-outfits on a czech server and nobody cares, but steal 100,000 user accounts and you will get mentioned on CNN.

     

    Concerns about the security of this were brought up in the beta. Long story short, it is more secure than Install Manager, it is no less secure than Studio was previously. The in app shop can only go to our store (and part of paypal for that payment method if chosen) and no cross site scripting vulnerability. If you happened to get someone to install something malicious on your system, be it a plugin or other program, there are a ton of much easier and more vulnerable attack vectors than trying to tie into a free 3D application to get, at most, a username and password, with no option to spread it.

    Given browsers, email clients, built in tools to your OS, messaging programs, etc., are such better and easier targets, the added "security risk" is so low, that only those that think it is prudent to build a faraday cage in their house level of paranoia would really worry about it.

    When comparing the comparative risks of DIM and Connect.

    1 DIM only on for a short time from my perspective.

    2 Connect is on (or would be if I used it) all the time 4.9 is being used; and I've no idea how vulnerable it is even with the functionality being blocked.#

    That's the think about vulnerabilities, they allow criminals (and possibly others?) to exploit a vulnerability.

    This is another reason I don't like 4.9, although I can monitor my internet connection using certain tools, I don't know if I'm missing something. That Faraday cage is looking really good about now. cheeky ... off to repair my tin hat.

    This is incorrrect.  Connect does not log in automatically, it's only on when you choose to login and you can log out at any time with one click.

    I realise that. It does in some way perform a hand-shake of some kind, otherwise it couldn't then log me in. But I know I'm paranoid, so realise some of what occurs to me is, lets say, out-there.

    As does DIM, or logging in with a browser.

    Of course, but I use DIM, then close it down; it's on for about five minutes as I have a fast connection. My browser, well that's a whole other story. I stick with firefox as I trust it more - the source code for example gets peer-reviewed. If I could get Daz working properly in Linux, I wouldn't be using Windows either - especially Windows 10; have you seen the EULA? But not related to this thread. I'm tech-savvy, which probably contributes to my paranoia. :)

    You can tell DS to store your log-in, but it's optional. If it doesn't store your log-in and isn't logged in then it knows nothing about your account at Daz and isn't comminicating with Daz (unless you opted in to the improvement programme).

  • HavosHavos Posts: 5,573
    a-sennov said:
    In the past there were some kind of .duf files that were not readable with a textfile reader like notepad etc.

    There may only have been very few posts that even mentioned this. The average users did not seem to have an issue with that.

    Did you not notice because in fact you actually never even bothered trying to fix .duf manually by editing the code?

    In all the time I only about three times edited a .duf file manually. In all the other times I wanted to edit a .duf I noticed that the .duf is encrypted, shrugged with the shoulders and moved on...

    I didn't mention it because it's the past. Those were .daz files, they were binary and also had encryption option but I usually hacked .cr2 and .pz3 that time :)

    And I doubt You want to be merely "average user". :)

    I wonder if those files aren't so much encrypted as compressed. And thus can be uncompressed. I do note that I'm not able to use products with .daz files that have been installed through connect. Which given that they're useful products from some notable PAs kinda bothers me, but I put a ticket in on that. Also I should be able to save the assets out in nice unencrypted .dufs I believe. If I can make them open. I think when I poked at them for the sake of being able to add some of my troubleshooting to the ticket, I was able to get them to open by setting the product folder as a base runtime for DAZ Studio content in the content pane. But as this affects several products, that's not an ideal solution. I suppose if I just copied them to my normal library it'd likely find them. It just seems whatever Connect is using to let products find their resources is not working for these particular products with that filetype. 

    But the point is compression is not the same thing. While a compressed file can be encrypted, and isn't readable plaintext, an non-encrypted compressed file can be uncompressed and read as normal. Just having a proprietary format isn't the same as having an encryption locked one. For a good example, I'll point to gaming. Most games use files that are specific to that game. But they're not encrypted to a specific user. So tools made to modify game files can be worked on by multiple people, who can puzzle out how to edit the files, and make mods that will work for others. And some games do encrypt their files or use compression methods not commonly available in order to prevent modification. The difference is, games are presented as something we're meant to use in the form the creators intended. Do you really want your 3d artistic content to be like that? People do wonderful creative things with content all the time through a variety of methods, including direct editing of the files. Locking the files to encrypted formats is pretty much demanding that we only color within the lines with the products.

    To the original post quoted: Just because you don't edit .duf files often doesn't mean there aren't users who do. And I'm sure if they encountered the compressed/binary ones, they saved them in a non-binary uncompressed form and went to editing. 

    And you shouldn't try to claim that all export options are the same when Daz has outright stated that Cararra's normal ability to read .dufs and the DSON plugin for Poser users do not work with encrypted content at this time. That's two options down, and the others are stated as being 'less than' what the product was originally. Which is how they had been, but now with less chance some bright person could write a plugin or converter to handle carrying over more functionality into other software.

    No way around it, DRM encryption cripples the products it's used on in order to lock them down. Maybe you don't need the lost functionality. Maybe most users don't. But there are people who relied on it to do their work with this software, and there's always the possibility of others running into a situation where such access could be useful only to have it denied.

    My understanding is that .daz files are mostly used for dynamic clothing products. I believe they are not encrypted, but they do use a completely undocument binary format, and the reason the spec is kept secret is so that people do not make their own dynamic clothing. This should only be done with an app from Optitex, a product, I believe, that costs 10s of thousands of dollars, and just a single DAZ PA has access to. Hence the rather small amount of dynamic clothing available in the store.

  • a-sennova-sennov Posts: 331

    I wonder if those files aren't so much encrypted as compressed.

    .daz files wasn't compressed, they were just binary files containing different protions of scene info - geometry, UVs. morphs. Roughly like modern .dsf/.duf. There also was option to encrypt them (AFAIR right in the Save as... dialog).

    ... But as this affects several products, that's not an ideal solution. I suppose if I just copied them to my normal library it'd likely find them. It just seems whatever Connect is using to let products find their resources is not working for these particular products with that filetype. 

    They were used to live in /data folder of the runtime and were dependent on their relative position, so if You can manage to move them into right places the product should start to work again :)

    But the point is compression is not the same thing. While a compressed file can be encrypted, and isn't readable plaintext, an non-encrypted compressed file can be uncompressed and read as normal. Just having a proprietary format isn't the same as having an encryption locked one. For a good example, I'll point to gaming. Most games use files that are specific to that game. But they're not encrypted to a specific user. So tools made to modify game files can be worked on by multiple people, who can puzzle out how to edit the files, and make mods that will work for others.

    Actually what matters here is ability to work with content legally. id Software's Quake IV has many game data in readable plain text  format (zipped in pack files) but they're still proprietary and they specifically allowed to modify them for limited set of modding purposes (before the engine was GPLed). On the other hand, DSON was invented and promoted as 'open' file format - you freely may produce yout own .duf/.dsf files and modify what you've got from stores (as far as EULA lets you :) ). Encryption gets it away from me, that's why I bother.

    And you shouldn't try to claim that all export options are the same when Daz has outright stated that Cararra's normal ability to read .dufs and the DSON plugin for Poser users do not work with encrypted content at this time. That's two options down, and the others are stated as being 'less than' what the product was originally. Which is how they had been, but now with less chance some bright person could write a plugin or converter to handle carrying over more functionality into other software.

    I could imagine script or plugin that walks through the scene tree and produces plain text DSON and writes it to the file. ... and then we'll get SDK with file write functions locked, like in Houdini, for example :)

     

    No way around it, DRM encryption cripples the products it's used on in order to lock them down. Maybe you don't need the lost functionality. Maybe most users don't. But there are people who relied on it to do their work with this software, and there's always the possibility of others running into a situation where such access could be useful only to have it denied.

    +1

  • BeeMKayBeeMKay Posts: 7,019

    Wouldn't the easiest solution for those who want to edit their dufs be either some "texteditor" function out of the box (DS native) or as free a plugin (as i can imagine that the majority of users will not have a desire to look into their dufs...)? That way, people could still edit, presumably even save the content of the duf out as text format, and do their editing/studying, while the files itself would still be encrypted. It would also add functionalty to DS, also for non-encrypted content.

  • TesseractSpaceTesseractSpace Posts: 1,582
    edited February 2016
    a-sennov said:
    ..all 3D asset stores working together in creating one categorisation system for all stores. DAZ3D could provide DAZ Connect as a central SERVICE to all other companies interested in sharing 3D content with their users.

    You don't need Connect for this - just standardized format for metadata, but this didn't happen as for now and not likely to be in the future.

    DAZ connect is the distribution system with the benefit that it shows both installed and uninstalled products.

    Metadata includes just the categories. Products of other stores are currently not uploaded on the DAZ connect server so you will not see uninstalled products from other stores in DAZ Studio "all" or "available" tabs.

    Example:

    You open up DAZ Studio and browse to the category wardrobe/shirts in the Smart Content Tab.

    Currently with DAZ Studio 4.9 you can see all installed and uninstalled products you purchased at DAZ3D.

    You can also see those products with metadata from other stores that are installed.

    Now imagine in the same spot all products you purchased in other stores that include shirts would show up in the same place no matter if they are installed or not.

    Currently you cannot right click uninstalled products of others stores directly in the DAZ Studio Smart content tab and download and install them because the other stores have not uploaded any products to the DAZ Connect Servers.

    - - -

    Just because something did not happen in the past does not mean that it must stay the same.

    Allready in the first metadata products of 2011 there was the option to add a store identifier to the metadata.

    And some vendors in other stores  did make an effort of adding categories to their products.

    Therefore it could very well be that some 3rd party stores or vendors might actually be interested to upload their products on the DAZ connect server so their customers could download them directly inside DAZ Studio as well.

    But probably it is a bit too early in the development cycle now and all the issues have to be sorted out before involving even more people...

    Anyway the reason why I brought this up is that I was under the impression that it does not have to be "X VS Y" but they could all find a way to work together if that makes sense for them from a business perspective.

    As utoptian as the idea of a unified market sounds, the realistic concern is who would dictate terms for that market. Connect as the de facto platform for the market would be an absolute disaster. Even if Daz didn't force controls on other markets to be allowed onboard, the idea that DAZ could simply cut the others off on a whim would have a seriously negative effect on the other stores. Plus it could hardly be in Daz's interest to promote other stores. I'm not even an economist and I can see that it wouldn't work. Plus trying to manage artists is like herding cats. Trying to manage several herds of cats is just insanity.

    Havos said:
    a-sennov said:
    In the past there were some kind of .duf files that were not readable with a textfile reader like notepad etc.

    There may only have been very few posts that even mentioned this. The average users did not seem to have an issue with that.

    Did you not notice because in fact you actually never even bothered trying to fix .duf manually by editing the code?

    In all the time I only about three times edited a .duf file manually. In all the other times I wanted to edit a .duf I noticed that the .duf is encrypted, shrugged with the shoulders and moved on...

    I didn't mention it because it's the past. Those were .daz files, they were binary and also had encryption option but I usually hacked .cr2 and .pz3 that time :)

    And I doubt You want to be merely "average user". :)

    I wonder if those files aren't so much encrypted as compressed. And thus can be uncompressed. I do note that I'm not able to use products with .daz files that have been installed through connect. Which given that they're useful products from some notable PAs kinda bothers me, but I put a ticket in on that. Also I should be able to save the assets out in nice unencrypted .dufs I believe. If I can make them open. I think when I poked at them for the sake of being able to add some of my troubleshooting to the ticket, I was able to get them to open by setting the product folder as a base runtime for DAZ Studio content in the content pane. But as this affects several products, that's not an ideal solution. I suppose if I just copied them to my normal library it'd likely find them. It just seems whatever Connect is using to let products find their resources is not working for these particular products with that filetype. 

    But the point is compression is not the same thing. While a compressed file can be encrypted, and isn't readable plaintext, an non-encrypted compressed file can be uncompressed and read as normal. Just having a proprietary format isn't the same as having an encryption locked one. For a good example, I'll point to gaming. Most games use files that are specific to that game. But they're not encrypted to a specific user. So tools made to modify game files can be worked on by multiple people, who can puzzle out how to edit the files, and make mods that will work for others. And some games do encrypt their files or use compression methods not commonly available in order to prevent modification. The difference is, games are presented as something we're meant to use in the form the creators intended. Do you really want your 3d artistic content to be like that? People do wonderful creative things with content all the time through a variety of methods, including direct editing of the files. Locking the files to encrypted formats is pretty much demanding that we only color within the lines with the products.

    To the original post quoted: Just because you don't edit .duf files often doesn't mean there aren't users who do. And I'm sure if they encountered the compressed/binary ones, they saved them in a non-binary uncompressed form and went to editing. 

    And you shouldn't try to claim that all export options are the same when Daz has outright stated that Cararra's normal ability to read .dufs and the DSON plugin for Poser users do not work with encrypted content at this time. That's two options down, and the others are stated as being 'less than' what the product was originally. Which is how they had been, but now with less chance some bright person could write a plugin or converter to handle carrying over more functionality into other software.

    No way around it, DRM encryption cripples the products it's used on in order to lock them down. Maybe you don't need the lost functionality. Maybe most users don't. But there are people who relied on it to do their work with this software, and there's always the possibility of others running into a situation where such access could be useful only to have it denied.

    My understanding is that .daz files are mostly used for dynamic clothing products. I believe they are not encrypted, but they do use a completely undocument binary format, and the reason the spec is kept secret is so that people do not make their own dynamic clothing. This should only be done with an app from Optitex, a product, I believe, that costs 10s of thousands of dollars, and just a single DAZ PA has access to. Hence the rather small amount of dynamic clothing available in the store.

    Wouldn't know about the dynamic clothing. I'm talking about stuff like Stonemason's Urban Sprawl 2. (A lovely set to be sure, but concrete and stone are rarely dynamic. Though it'd be funny to watch a dynamics simultation where it was turned to cloth and buildings all fell into a pile...)

    Post edited by TesseractSpace on
  • nicsttnicstt Posts: 11,715
    nicstt said:
    nicstt said:
    nicstt said:
    DAZ_Jon said:

    Personally i have nothing against the encryption. As long as they are marking the releases accordingly, i can decide on an item-by-item basis if i would buy it or not. The same as for other items. Daz might just as well say "our sales team has found out, that pirates do copy bikinis less than other items, therefore we will release every other item in a bikini-version only". So less piracy, no harm done for anyone (except for the people, who irrationally refuse to render bikinis, who probably are the minority anyway).
    What i find far more interesting is the fact, that DazConnect uses the actual user account name and password for its connect. That opens a lot of possibilities what can be done with DS4. I mean, i could hack DS4.8 and the best piece of data i could get out of it is its serial number. I could use that serial number to .... hm, only to run DS4, which is free anyway; how boring.
    On the other hand if i can hack DS4.9 with (an enabled) DazConnect in it, in addition to the serial number, i will also get an account name and a password, that seems much more valueable. I could use that to sniff around the orders of the user, get a real name, posting spam and whatnot. I might even get lucky and the user has used the same password for other sites which i could try out.
    There is also some kind of builtin browser within the smart content panel in DS4.9. I mean: it looks like a browser, but it has not that warning that pops up if the https-certification failed, although i did not try that. If i hacked into DS4.9 i would swap that out against my own version anyway. I wonder if someone could be that trusty to enter their credit card info into it. Probably no one, but it might be worth trying.
    So basic question is: how hard is it to hack into DS4.9? Likely the easiest way is using the plugin-mechanism. Several third party plugins are already available. I guess not even Daz knows what these plugins do exactly. There is even a Reality plugin available on renderosity, completely out of Daz's control. So after the next time renderosity gets hacked, that plugin might not do the exactly the same as it did before renderosity got hacked. The user's best bet then is probably to completely remove their Daz account (and create a new one). And there is also a question connecting it to the encryption-problem: When i remove my account (which might be necessary in such a case), how do i get my licenses back?
    In summary DazConnect might scare away some pirates, but creates a big security hole, which might attract a whole different kind of computer criminals, who are capable of doing much more damage if they succeed. Anyone can put some 1Mio Vicky-outfits on a czech server and nobody cares, but steal 100,000 user accounts and you will get mentioned on CNN.

     

    Concerns about the security of this were brought up in the beta. Long story short, it is more secure than Install Manager, it is no less secure than Studio was previously. The in app shop can only go to our store (and part of paypal for that payment method if chosen) and no cross site scripting vulnerability. If you happened to get someone to install something malicious on your system, be it a plugin or other program, there are a ton of much easier and more vulnerable attack vectors than trying to tie into a free 3D application to get, at most, a username and password, with no option to spread it.

    Given browsers, email clients, built in tools to your OS, messaging programs, etc., are such better and easier targets, the added "security risk" is so low, that only those that think it is prudent to build a faraday cage in their house level of paranoia would really worry about it.

    When comparing the comparative risks of DIM and Connect.

    1 DIM only on for a short time from my perspective.

    2 Connect is on (or would be if I used it) all the time 4.9 is being used; and I've no idea how vulnerable it is even with the functionality being blocked.#

    That's the think about vulnerabilities, they allow criminals (and possibly others?) to exploit a vulnerability.

    This is another reason I don't like 4.9, although I can monitor my internet connection using certain tools, I don't know if I'm missing something. That Faraday cage is looking really good about now. cheeky ... off to repair my tin hat.

    This is incorrrect.  Connect does not log in automatically, it's only on when you choose to login and you can log out at any time with one click.

    I realise that. It does in some way perform a hand-shake of some kind, otherwise it couldn't then log me in. But I know I'm paranoid, so realise some of what occurs to me is, lets say, out-there.

    As does DIM, or logging in with a browser.

    Of course, but I use DIM, then close it down; it's on for about five minutes as I have a fast connection. My browser, well that's a whole other story. I stick with firefox as I trust it more - the source code for example gets peer-reviewed. If I could get Daz working properly in Linux, I wouldn't be using Windows either - especially Windows 10; have you seen the EULA? But not related to this thread. I'm tech-savvy, which probably contributes to my paranoia. :)

    You can tell DS to store your log-in, but it's optional. If it doesn't store your log-in and isn't logged in then it knows nothing about your account at Daz and isn't comminicating with Daz (unless you opted in to the improvement programme).

    I'm paranoid, so take a guess.

  • KeryaKerya Posts: 10,943

    This is incorrrect.  Connect does not log in automatically, it's only on when you choose to login and you can log out at any time with one click.

     

    Does it store login data or not?

     

  • Kerya said:

    This is incorrrect.  Connect does not log in automatically, it's only on when you choose to login and you can log out at any time with one click.

     

    Does it store login data or not?

     

    Only if you tell it to - there's a Remember me check box, which is off by default.

  • KeryaKerya Posts: 10,943
    Kerya said:

    This is incorrrect.  Connect does not log in automatically, it's only on when you choose to login and you can log out at any time with one click.

     

    Does it store login data or not?

     

    Only if you tell it to - there's a Remember me check box, which is off by default.

    Sounds better! Thank you!

  • Oso3DOso3D Posts: 15,085
    Havos said:

    It would take a lot for me to go to this extreme, I have so much back catalogue stuff I still want, I shall likely remain a member for a few years yet, no matter what. To me the PC+ represent such good value, particularly if you grab a years membership at some bargain price. I have never paid more than $35 for a full year (my first year was effectively free), that's about the same as rendo's prime club, and the perks offered by PC+ compared to prime are vastly better imho. Anyway it is a mute point for now, I am a paid up member until some time into 2017, and will remain one for at least 2-3 years beyond that. After that, if every new release is being encrypted, then I will reassess.

    Will, I hope you will still post here, even if you shop elsewhere.

    Oh sure, I love the community. Just not happy about DRM and other stuff. I do hold out hope that DRM will be a miserable failure and Daz will announce some face-saving 'we are moving in a new direction' and quietly retire it. If my cancelation can be part of any larger message of 'no, this stinks, please stop,' then it's worth it.

    PC+ IS a good value, if you can figure out how to apply the coupons. And I do have an extensive wishlist.

     

    But there's only a dozen or so things that I feel I _NEED_ that I can only find here, rather than the much longer list of stuff that would be cool. By the time my account expires I should get those things and then I'll be done.

     

     

  • Kerya said:

    This is incorrrect.  Connect does not log in automatically, it's only on when you choose to login and you can log out at any time with one click.

     

    Does it store login data or not?

     

    Like most such things, there's a 'remember me' option that would store data. Hopefully in a encrypted form for our safety. If you uncheck that, it shouldn't save anything. It didn't when I tested it a minute ago. (Unchecked, logged in, work offline, login again - no username or password filled in.)

  • Havos said:
    a-sennov said:
    In the past there were some kind of .duf files that were not readable with a textfile reader like notepad etc.

    There may only have been very few posts that even mentioned this. The average users did not seem to have an issue with that.

    Did you not notice because in fact you actually never even bothered trying to fix .duf manually by editing the code?

    In all the time I only about three times edited a .duf file manually. In all the other times I wanted to edit a .duf I noticed that the .duf is encrypted, shrugged with the shoulders and moved on...

    I didn't mention it because it's the past. Those were .daz files, they were binary and also had encryption option but I usually hacked .cr2 and .pz3 that time :)

    And I doubt You want to be merely "average user". :)

    I wonder if those files aren't so much encrypted as compressed. And thus can be uncompressed. I do note that I'm not able to use products with .daz files that have been installed through connect. Which given that they're useful products from some notable PAs kinda bothers me, but I put a ticket in on that. Also I should be able to save the assets out in nice unencrypted .dufs I believe. If I can make them open. I think when I poked at them for the sake of being able to add some of my troubleshooting to the ticket, I was able to get them to open by setting the product folder as a base runtime for DAZ Studio content in the content pane. But as this affects several products, that's not an ideal solution. I suppose if I just copied them to my normal library it'd likely find them. It just seems whatever Connect is using to let products find their resources is not working for these particular products with that filetype. 

    But the point is compression is not the same thing. While a compressed file can be encrypted, and isn't readable plaintext, an non-encrypted compressed file can be uncompressed and read as normal. Just having a proprietary format isn't the same as having an encryption locked one. For a good example, I'll point to gaming. Most games use files that are specific to that game. But they're not encrypted to a specific user. So tools made to modify game files can be worked on by multiple people, who can puzzle out how to edit the files, and make mods that will work for others. And some games do encrypt their files or use compression methods not commonly available in order to prevent modification. The difference is, games are presented as something we're meant to use in the form the creators intended. Do you really want your 3d artistic content to be like that? People do wonderful creative things with content all the time through a variety of methods, including direct editing of the files. Locking the files to encrypted formats is pretty much demanding that we only color within the lines with the products.

    To the original post quoted: Just because you don't edit .duf files often doesn't mean there aren't users who do. And I'm sure if they encountered the compressed/binary ones, they saved them in a non-binary uncompressed form and went to editing. 

    And you shouldn't try to claim that all export options are the same when Daz has outright stated that Cararra's normal ability to read .dufs and the DSON plugin for Poser users do not work with encrypted content at this time. That's two options down, and the others are stated as being 'less than' what the product was originally. Which is how they had been, but now with less chance some bright person could write a plugin or converter to handle carrying over more functionality into other software.

    No way around it, DRM encryption cripples the products it's used on in order to lock them down. Maybe you don't need the lost functionality. Maybe most users don't. But there are people who relied on it to do their work with this software, and there's always the possibility of others running into a situation where such access could be useful only to have it denied.

    My understanding is that .daz files are mostly used for dynamic clothing products. I believe they are not encrypted, but they do use a completely undocument binary format, and the reason the spec is kept secret is so that people do not make their own dynamic clothing. This should only be done with an app from Optitex, a product, I believe, that costs 10s of thousands of dollars, and just a single DAZ PA has access to. Hence the rather small amount of dynamic clothing available in the store.

    .daz was the scene format in DS 0-3, and was used in the early betas of 4. Dynamic Clothing tends to be in that format as it is mostly older, though it is in a proprietary form as far as I am aware however it is delivered (as are other features such as the two strand hair plug-ins).

  • a-sennova-sennov Posts: 331
    BeeMKay said:

    Wouldn't the easiest solution for those who want to edit their dufs be either some "texteditor" function out of the box (DS native) or as free a plugin (as i can imagine that the majority of users will not have a desire to look into their dufs...)? That way, people could still edit, presumably even save the content of the duf out as text format, and do their editing/studying, while the files itself would still be encrypted. It would also add functionalty to DS, also for non-encrypted content.

    Yes, but good text editor/IDE for Qt is the story of it's own :) - maybe Qt Creator may be appropriately licensed, I just cannot guess.

  • BeeMKay said:

    Wouldn't the easiest solution for those who want to edit their dufs be either some "texteditor" function out of the box (DS native) or as free a plugin (as i can imagine that the majority of users will not have a desire to look into their dufs...)? That way, people could still edit, presumably even save the content of the duf out as text format, and do their editing/studying, while the files itself would still be encrypted. It would also add functionalty to DS, also for non-encrypted content.

    I think the issue would be that it would negate the 'benefit' of the DRM encryption. Namely preventing the export of the .duf in a potentially usable format. While such a plugin would be handy for non-encrypted content, if it covered encrypted then it would have to have blocks to prevent any possibility of someone getting the text out of the program, because if you get the raw text of an encrypted file and change the extension to .duf, you've got an unencrypted version with all the functionality the encryption was protecting.

  • HeraHera Posts: 1,958
    edited February 2016

    I'm glad I came in here late and missed most of the hubbub with the toll booth, because I'd probably blown another set of fuses. After all it's a useful little goodie, and being deprived of that one would've annoyed me just as much as I was annoyed when the PC freebie for November was cancelled. Now I just thought it a bit of an irony that it was a TOLL BOTH that caused all this annoyance. And I can spend time being annoyed with yet another complicated sale instead.  

    With that said I really hope DAZ will listen as in LISTEN and not as in "listen". Otherwise I fear a slow degradation to more and more encrypted materials on the site, and with that at least I too will be heading in another direction. Just as I refused to buy copy protected CDs back in the days until I learned how to get around that obstacle. Because, as someone said, I don't want to be regarded as a thief just for shopping here, and I don't want to end up in a situation should DAZ go bankrupt and someone else acquires the crypto keys and decide to charge me again for something I already bought. Or everything else which can go wrong when you don't have full access to your goods.

     

     

    Post edited by Hera on
  • Hera said:
    and I don't want to end up in a situation should DAZ go bankrupt and someone else acquires the crypto keys and decide to charge me again for something I already bought.

    Which is what DAZ_Steve's opening post was about - ensuring that in that event the tool to decrypt the content would be made available.

  • LeanaLeana Posts: 12,737
    BeeMKay said:

    Wouldn't the easiest solution for those who want to edit their dufs be either some "texteditor" function out of the box (DS native) or as free a plugin (as i can imagine that the majority of users will not have a desire to look into their dufs...)? That way, people could still edit, presumably even save the content of the duf out as text format, and do their editing/studying, while the files itself would still be encrypted. It would also add functionalty to DS, also for non-encrypted content.

    There is already a text editor in DS. I don't think it can read encrypted files though...

  • a-sennova-sennov Posts: 331
    BeeMKay said:

    Wouldn't the easiest solution for those who want to edit their dufs be either some "texteditor" function out of the box (DS native) or as free a plugin (as i can imagine that the majority of users will not have a desire to look into their dufs...)? That way, people could still edit, presumably even save the content of the duf out as text format, and do their editing/studying, while the files itself would still be encrypted. It would also add functionalty to DS, also for non-encrypted content.

    I think the issue would be that it would negate the 'benefit' of the DRM encryption. Namely preventing the export of the .duf in a potentially usable format. While such a plugin would be handy for non-encrypted content, if it covered encrypted then it would have to have blocks to prevent any possibility of someone getting the text out of the program, because if you get the raw text of an encrypted file and change the extension to .duf, you've got an unencrypted version with all the functionality the encryption was protecting.

    Just imagined: right click on node in Scene pane or on parameter in Parameters or directly in the Viewport and there is an action in context menu - 'Edit this...', you select it and editor opens with proper .dsf loaded, cursor is on selected element, syntax highliting, indentation, context assistance etc. You make changes and hit 'Hot reload' button and scene changes accordingly...

    Definitely, I'd kill for this feature. :)

  • Point 1:

    How exactly is encryption in its current form affecting users with a game developers license?

    All export options are exactly the same as before.

    Am I missing something?

    DRM means we can no longer fix issues in e.g. .duf files, wich means we have to rely on DAZ's virtually non-existent tech support. If this is a hobby, mayber that's liveable, but if it's an important asset in a business effort it's not. It also raises the question of what will DAZ do next, and not in a good way.  DRM is at best is transparent to the user but more imprtantly at worst denies the user access to the product. That's a new risk that has been introduced. If I am planning on working on a two year effort to make a game (maybe longer say based on kickstarter efforts, the inevitable delays, etc.), what will the DAZ landscape look like in a year from now? In two? Ditto for other bussiness eforts that rela heavily on the content. The bottom line is do you want to work with the company that is trying to force DRM onto its customers or with companies that are not? All else being equal, the answer is obvious. From a "minimizing your risk" business standpoint, the only reason to ship at DAZ today is if they are the only ones that have the content that you need, whereas pre-DRM, it was a great store to shop at overall.

This discussion has been closed.