Vitanuova for 2004 October 8

Google Print vs. Amazon Search Inside the Book

Several people suggested I compare Google Print with Amazon Search Inside the Book. I signed up for an Amazon account for the first time in years (I'd been adhering strictly to the Free Software Foundation's Amazon boycott, which I didn't even know had ended until I looked at the FSF site while writing this entry). The comparisons are relatively straightforward. First I'll talk about non-DRM functionality. Here are the advantages of Google over Amazon:

1. Google Print is integrated with Google.
2. Google Print appears to have pages scanned at a higher resolution, although it's been difficult for me to tell for sure because I haven't been able to get the same page from each.

And here are the advantages of Amazon over Google:

1. Amazon's search has (at the moment) more books included. Because of Amazon's relationships with publishers, it might take Google a long time to catch up.
2. Amazon's search appears to allow you to view more pages of a single book from a single search than Google Print does. There is a way to get Google Print to show you more pages (by doing a new search for a sentence on the last page Google Print was willing to show you), but it isn't automated and requires a good deal of human effort.

All right, how about the measures used to prevent people from saving the images? Here I was surprised at the result, because among friends of mine who are likely to have a strong opinion about this kind of thing, Amazon has a poor reputation and Google has an excellent reputation. Nonetheless, Google has exerted more effort to stop people from saving images from Google Print and it is significantly easier to save images from Amazon's search.

Amazon uses a JavaScript that prevents people from right-clicking on images, but merely disabling JavaScript was completely sufficient to allow me to save them directly from FireFox. What's more, from the Amazon search, I could immediately see the precious image in Page Info as well as the DOM Inspector. (Amazon also does not check referer, and you can get a URL from the DOM Inspector that will work directly. I have not investigated whether either Amazon or Google uses cookies to verify that you have personally performed a search that actually resulted in the particular book page of interest.)

By contrast, none of these methods worked with Google, and I had to resort to much more involved techniques to save precious images from Google Print.

There are (since security is observer-relative and, as Bruce Schneier says, security will always shift "power in varying degrees to one set of players from another") at least two ways of looking at this contrast. One is to say that Google has engaged in better engineering than Amazon; it has obviously spent more time and engaged in more resources trying to figure out how to prevent people from saving images from modern HTML pages. The other is to say that Google has imposed more restrictions on its users than Amazon has, and that Amazon has done a better (less bad) thing by not trying hard to disable end users' browser features.

I think it's a good thing, a powerful thing, to read advertising that isn't directed at you. I had a fascinating time last summer when National Journal favored EFF with a free introductory subscription. National Journal is among the top two or three insider publications about U.S. Federal politics, and, as one lawyer put it, talks about "what the real political issues are" and "how the government actually makes decisions" rather than the television or civics-class or Presidential debate versions of those topics. It costs more to subscribe than I can ever imagine being able to afford, and it's a really useful publication. Almost nobody knows about its existence apart from people who do politics professionally, including members of Congress and Congressional staffers. The most fascinating thing about reading National Journal isn't the reporting, though, although it's really excellent. It's the advertising. Ads in National Journal don't promote toothpaste or liquor or perfume or cars (at least not particular brands). They promote things like weapons systems, like industries, like legislation. Our helicopter is more lethal and cheaper. Our industry employs millions of people. Our bill will create jobs and a level playing field. I had never seen ads like those before; at first, I thought they were a joke. They're not. They're just not aimed at me; they're aimed at Congressional staff. They're constructed just like regular advertising, and they're aimed at someone completely different from you.

Here is some Google advertising that isn't aimed at you (unless you're a commercial publisher):

Google Print is a book marketing program, as opposed to an online library [...]

It's from the Google Print FAQ for Publishers, all of which is aimed at commercial publishers (not you). (P.S. to Google: how come the Publisher FAQ defaults to HTTPS, where the Consumer FAQ isn't even available in HTTPS -- trying it in HTTPS just redirects you to the Google home page?)

In one sense, Google Print's customers are commercial publishers rather than end users (much as Google Search's customers are advertisers rather than end users, as is the case with a number of other advertising-supported services). If you think of it that way, you could conclude that Google Print's more restrictive coding is a better service to Google Print's customers. If you were involved in the Dmitry Sklyarov case, you might remember the perennial oddity: Adobe kept saying that Adobe eBook DRM was a good idea. Activists pointed out that customers (end users) hated it. Cleverer activists pointed out that Adobe's DRM customers are not end users; they're commercial publishers. Commercial publishers often feel that they have different interests from their customers; people who supply or market to commercial publishers, like Adobe and now like Google, are apt to feel an urge to make their immediate customers happy and leave a portion of the task of making end users happy to others. I don't think that this is an absolute division, merely because commercial publishers and readers have an "incomplete antagonism" rather than a "complete antagonism". Therefore Google would also, for example, like end users to like Google Print, not least so they keep coming back and increasing their use of other Google services.

I don't have a specific conclusion about whether Amazon or Google has a better book search overall. Amazon so alienated me with its patent litigation against Barnes and Noble that, even though the FSF called off the boycott, it's hard for me to imagine myself using Amazon again on a regular basis. As a rule, I don't like e-books (even open format e-books; I buy DRM-restricted e-books only in the course of making political or technical criticism of them and never to read). I prefer paper books, which I normally buy through Powell's, Bookfinder.com, and in person from local independent book stores. But I often wish that I could find a particular phrase again months or years after reading it. I already do Google searches in the hope of finding references to those phrases; I can imagine Google Print increasing the frequency with which those searches find success. (I haven't seen whether Google Print will be able to handle wildcard searches; that will be interesting, too.)

I have some more general conclusions to offer, rather than preferring one search service over another.

First, the web standards developers have done a great job in keeping HTML and other web standards human-readable, open, and typically relatively close to the source code from which they're generated. I'm aware of other criticisms of them, but they've done a great thing here, and I hope they keep it up. Google knows that it would be badly disserved by a change away from web standards compliance, so notwithstanding what some commercial publishers might want, I don't think it will ever do anything to damage the value that web standards have created.

Second, Mozilla developers have done a great job in creating a high-quality free software browser that responds directly to its users' demands and is accountable solely to them. It's amazing to see that it takes less than a day between a user's complaint about how Mozilla deals with a site and the time Mozilla developers suggest workarounds or even begin to implement fixes within Mozilla. (And this is true whether the user's difficulties are intentional or unintentional on the part of the site's author.) I'll say again that I think Mako is right that free software is unique in being solely accountable to end users in the long term. (It is possible that there are economic situations where users might not be served well by that kind of accountability, but it's not easy for me to believe that they're the rule. People who work in advertising, maybe including most every non-technical person at Google, may come to develop a different intuition, especially because many of the most famous examples of "accountability to users" seem to center on allowing users not to view advertising they don't like.)

Third, this experience seems to be providing actual ideas for feature enhancements in Mozilla, and I look forward to them. I'll keep on eye on Gervase Markham's site.

Slow attestations don't work very well

Ed Felten pointed out something that I had been worrying about in the back of my mind: my "slow attestations" scheme (see my suggestion, discussion on the Cryptography list, Unlimited Freedom's critique, and the EFF comments on the TCG Principles, where slow attestations are discussed in section 6.4) has a serious flaw. The trouble is severe enough that slow attestations probably won't accomplish what I wanted them to.

Felten observes that sealed storage can be used as a sort of proxy for attestation. (I discuss that in section 6.1 of the EFF comments mentioned above.) That is, a given entity can use sealed storage as a way to verify that the state of a machine is the same at some future time as it is at the present. It does this by generating a secret, somehow ascertaining the present state of the machine, and asking the machine to seal the secret. Later, the entity can challenge the machine by asking it to hash the relevant secret with a nonce; if the machine responds correctly, then, assuming sealed storage is secure and works as designed, the machine's state must be the same as it was when the secret was sealed. There are some fine details here, but in theory this should work.

Felten observes that this way of using sealed storage undermines the effectiveness of slow attestations, because slow attestations were meant to make it expensive to ascertain the state of a machine every time anyone tries to do so. However, sealed storage would allow somebody to use attestation (including slow attestation) just once to verify a machine's state, and then issue it a key, token, or even a cryptographic certificate that serves to prove that state as rapidly as desired any time in the future. That makes the expense of verifying a slow attestation an expense that only has to be incurred once per machine (perhaps more precisely, once per machine/OS configuration/application combination, as Felten notes), and only has to be incurred by a single party, since that party can then act as a certifier, if other parties trust it.

I haven't been able to come up with a countermeasure that would restore the benefit of slow attestations. It would, of course, be possible to tinker with sealed storage as well as attestation, but I'm afraid that sort of speculation leads to chaos as well as an arguments that it would significantly increase the cost of implementing the TPM specification.