| HN Mirror

XOR is also great for storing copyrighted works without liability.

a = the bits of some song or movie

b = pure noise

Store c = a^b.

Give b to a friend. Throw away a.

Now both you and your friend have a bit vector of pure noise. Together you can produce the copyrighted work. But nobody is liable.

> https://ansuz.sooke.bc.ca/entry/23

aleph_minus_one 63 days ago

This is the "What Colour are your bits?" argument:

> https://ansuz.sooke.bc.ca/entry/24

As these article outline, the legal situation is much more complicated (and unintuitive to people who are used to "computer science thinking").

This is because legal people want something to exist that does not physically exist.

There is no trace back from pure noise to the original work.

Colour of bits is just magical thinking.

TeMPOraL 63 days ago

Colour of bits isn't a property of bits. It's provenance. It's facts about history of the things.

There may be no trace from pure noise to original work, but you didn't get that particular noise randomly, you in fact got it from the original work.

Once you understand that law cares less about the thing itself, and more about the causal chain that led to it, it stops seeming magical and becomes perfectly reasonable.

(Also, FWIW, it's not that far conceptually from code = data, but there's still tons of technical people who can't comprehend the fact that there is no code/data distinction in reality. "Code" vs "data" too isn't a property of bits, it's only a matter of perspective.)

That's true, but without a warrant the law cannot see how someone fabricated that noise.

TeMPOraL 63 days ago

In this particular case there's also the simpler, more technical/mathematical argument: you cannot possibly just "accidentally" have that exact noise. Getting those specific bits instead of any other sequence from the space of random numbers that much long requires you to extend effort at least equivalent to possession of the exact copyrighted work that happens to fall out of the XOR exercise.

direwolf20 63 days ago

There is no trace from a dead body back to the original act of killing, but police regularly manage to link them anyway (at least when the body had a large enough bank account).

They do this by means such as "questioning people" and "finding evidence". For example, if you have a file on your computer describing your plan to use XOR to infringe copyright, that would be considered "evidence".

This steps over the fact that the first crime is considerably messy while the other is extremely clean and can be committed where the law cannot see without a warrant.

moi2388 63 days ago

Ha, but the neat trick is that I instead posted this on a distributed system that.. hey, wait a minute..

aleph_minus_one 63 days ago

> This is because legal people want something to exist that does not physically exist.

No law exists "physically".

Otherwise: Even in Computer Science the situation is more complicated, as is explained in the linked articles). Relevant excerpt from the first linked article:

"Child pornography is an interesting case because I find myself, and I think many people in the computing community will find themselves, on the opposite side of the Colourful/Colour-blind gap from where I would normally be. In copyright I spend a lot of time explaining why Colour doesn't exist and it doesn't matter where the bits came from. But when it comes to child pornography, I think maybe Colour should make a difference - if we're going to ban it at all, it should matter where it came from. Whether any children were actually involved, who did or didn't give consent, in short: what Colour the bits are. The other side takes the opposite tack: child pornography is dangerous by its very existence, and it doesn't matter where it came from. They're claiming that whether some bits are child pornography or not, and if so, whether they're illegal or not, should be entirely determined by (strictly a function of) the bits themselves. Legality, at least under the obscenity law, should not involve Colour distinctions.

[...]

The computer science applications of Colour seem to be mostly specific to security. Suppose your computer is infected with a worm or virus. You want to disinfect it. What do you do? You boot it up from original write-protected install media. Sure, you have a copy of the operating system on the drive already, but you can't use that copy - it's the wrong Colour. Then you go through a process of replacing files, maybe examining files, swapping disks around and carefully write-protecting them; throughout, you're maintaining information on the Colour of each part of the system and each disk until you've isolated the questionable files and everything else is known to be the "not infected with virus" Colour. Note that developers of Web applications in Perl use a similar scorekeeping system to keep track of which bits are "tainted" by influence from user input.

When we use Colour like that to protect ourselves against viruses or malicious input, we're using the Colour to conservatively approximate a difficult or impossible to compute function of the bits. Either our operating system is infected, or it is not. A given sequence of bits either is an infected file or isn't, and the same sequence of bits will always be either infected or not. Disinfecting a file changes the bits. Infected or not is a function, not a Colour. The trouble is that because any of our files might be infected including the tools we would use to test for infection, we can't reliably compute the "is infected" function, so we use Colour to approximate "is infected" with something that we can compute and manage - namely "might be infected". Note that "might be infected" is not a function; the same file can be "might be infected" or "not (might be infected)" depending on where it came from. That is a Colour.

[...]

Random numbers have a Colour different from that of non-random numbers. [...]

Note my terminology - I spoke of "randomly generated" numbers. Conscientious cryptographers refuse to use the term "random numbers". They'll persistently and annoyingly correct you to say "randomly generated numbers" instead, because it's not the numbers that are or are not random, it's the source of the numbers that is or is not random. If you have numbers that are supposed to come from a random source and you start testing them to make sure they're really "random", and you throw out the ones that seem not to be, then you end up reducing the Shannon entropy of the source, violating the constraints of the one-time pad if that's relevant to your application, and generally harming security. I just threw a bunch of math terms at you in that sentence and I don't plan to explain them here, but all cryptographers understand that it's not the numbers that matter when you're talking about randomness. What matters is where the numbers came from - that is, exactly, their Colour.

So if we think we understand cryptography, we ought to be able to understand that Colour is something real even though it is also true that bits by themselves do not have Colour. I think it's time for computer people to take Colour more seriously - if only so that we can better explain to the lawyers why they must give up their dream of enforcing Colour inside Friend Computer, where Colour does not and cannot exist."

pjc50 63 days ago

Whether people are liable is a question for the courts, and I suspect they simply look through the tech and ask "do you end up with a copy of the work?"

(unless you're an AI company, in which case you can copy the whole internet just fine)

But that's an unsolvable question. Just like when A is caught on camera stealing a diamond, but A turns out to have an identical twin B. So the prosecutor can't do anything.

crustaceansoup 63 days ago

And you could say the same is true if you lost an AES key. But if they can establish a chain of evidence that shows (to whatever degree the court you're in requires) that it does contain the work, you've lost.

How many ways could they do this? Could they note in court that they found you getting your copy from a "super secure no liability legal loophole" piracy service? Could they just get B's side, whether through subpoena or whatever mechanism you have to communicate with B? (You must, since your file is "just noise" and useless to you as it is)

AlienRobot 63 days ago

It's an unsolvable question if you assume the judge is a moron.

That's called encryption using a one time pad.

That's one way of looking at it. Note that you can easily extend it to multiple people holding multiple keys, so that a=b^c^d^e, etc.

My point was that encrypting a copyrighted work does not remove the copyright from it; the result is still copyright and not legally redistributable.

jagged-chisel 63 days ago

I think the topic is “evidence of infringement is no longer readily available” not “suddenly, there is no infringement!”

IncreasePosts 63 days ago

The evidence of infringement would be apparent when b and c were colocated and there was a utility next to them for XORing files and piping it into VLC

I didn't read it that way - the OP said "liability", after all, not "detection".

But, meh, could just be he meant "won't get caught" and not "liability"; I make mistakes in comms all the time, after all.

Maybe, but b and c are indistinguishable from pure noise.

> Maybe, but b and c are indistinguishable from pure noise.

That's the whole point of encryption.

morning-coffee 63 days ago

Right. But the copyright was violated when you used 'a' to begin with.

nkrisc 63 days ago

Crimes aren’t legal just because you hide it. Intent matters.

Law is more akin to philosophy than computer science.

meindnoch 63 days ago

Pretty sure the law doesn't care about this XOR trick.

ChrisRR 63 days ago

What if I listen to pure noise anyway?

sph 63 days ago

You have invented one-time pads.

JTbane 63 days ago

I mean, this is just a one-time pad and I'm sure a court could compel your friend to give up the data.

What exactly does it prove if my friend gives up their bit vector?

xorl 63 days ago

hah! Love it.

direwolf20 63 days ago

Important note: Only if you already know which one was corrupted.

danhau 61 days ago

True! Some checksums / parity bits might be needed.

nsteel 63 days ago

Also to cheaply (area) create multi-port RAMs.

How does that work?

It's similar to RAID schemes but instead of drive failure it's port unavailability. There's a reference at [1] or an FPGA-centric one at [2], but it applies to anywhere where dual/single-port rams are readily available but anything more exotic isn't.

  [1] Achieving Multi-Port Memory Performance on Single-Port Memory with Coding Techniques - https://arxiv.org/abs/2001.09599
  [2] https://people.csail.mit.edu/ml/pubs/fpga12_xor.pdf

Terr_ 63 days ago

See also: RAID levels that use one disk for parity. Three disks is simplest, but technically you can do more if you trust that only one will go bad at a time.

A few months ago, I had a rare occasion of trying to explain them to a relative who had just bought a fancy NAS and wanted help setting it up.