Security of copying, exporting files. (Discuss)

Hello world!

I would like to clarify, learn, and discuss this topic. Because I have never seen such a discussion in my circle of friends, close communities. How the free software community will react to this idea and who is for and who is against, and why.

My position on this matter is this: “Any creativity should be evaluated by the creator himself.” For free, or to sell your work is everyone’s business, but the issue of security, in my opinion, concerns each of us, and this is not limited to the conditional “Company”. In addition, I can not figure out if this license allows you to sell the same add-ons? I would appreciate help and clarification.

Draining information is a drain, theft, lack of honesty, not openness, many more unpleasant qualities, and none of these people will say “I stole from you.”

My idea is here:

Blender add-ons must be GPL licensed (at least the Python portion). You must make all add-on code open source. You can still sell open source code commercially, I do it all the time (as do other add-ons sellers), but you can’t prohibit distribution or modification

1 Like

Roughly speaking, such protection does not make sense? Because open source = open door for hacking?

On the other hand, 7z is also a free code, but it has encryption or password protection, regardless of whether the code is opened.

Yes, most likely it will be possible to hack, but with what difficulty! If the asset base is 100+GB of separate files, then hardly anyone will do it.

It’s one thing when you make models or an addon for sale, and you understand that this file can be easily distributed, but another thing, when you make a personal asset base, for example, for rendering, and you are not going to sell files and materials.

The problem is that if a third party can open it in a blender, then there are no restrictions on theft. If the saving is not on a flash drive, then in the cloud storage using any browser.

The only reasonable asset protection I have seen was to only give people remote access to the computers which run Blender (with access to the assets).

Not at all. If anything, it’s easier to patch security vulnerabilities when the community can see the code. For example, Firefox is open source, and it’s one of the most secure browsers

2 Likes

But, if there is access to assets, which prevents you from exporting or resaving the desired file, and, as I said above, throw it into the cloud. Then it turns out that you need to limit everything except the desktop, up to the browser, or sites. As far as I know, systems do not allow copying to be disabled separately, because Read = Copy permission.

Can you give an example? Maybe I misunderstood

Well, yes, I agree!
Well, what do you think, how positively will the developers respond to such a development, will they be interested?

Let the people you don’t trust only work in Blender through a remote connection which only provides access to Blender.

Well, I think there is no problem with this, but how to limit the ability of blender to save or export to third-party places, while giving access to assets. Simply, if you give the whole asset, then I still don’t see the difficulty of emptying it with just one file.

There is certainly not a bad option, disable all possible USB and drives. But there are still questions.

Simply, if I correctly imagine working with assets, then the assets folder for me personally = working folder.

The problem here is that in these folders there are materials that I have no right to distribute, such as personal photos that I have to use for people. Even the portraits I do have to ask permission to post a portfolio or some kind of advertisement.

Interesting discussion !

As other said, I tend to agree that it’s not the job of blender to provide file encryption, and furthermore it’s a whole field, how can we be sure that the encryption system will be efficient if there is no expert in that field among blender developers ?
Furthermore , should that encryption should encompass images, videos, .fbx, .abc, and nearly every files then ?

I think in general if you manipulate sensible information , say your company do 3D visualization of military technology. Then the whole company needs to be “secured” and you also need to work with people that you can trust.
At some point you’ll have stuff like computers without USB drives and a limited internet access.
Obviously the security of the company should be treated as a whole by a specialist.

Now say for a classic animation or VFX project, having file encrypted will probably do more harm than good. Since studios are generally working together they need to be able to simply share and open files.
Many times I copied my work on a USB stick to catch up or do some tests during the weekend, it’s part of the life of a project to meet deadlines.

In the end, the project is also protected by it’s own identity : Say I worked on a star wars project and I copied illegally a bunch of spaceship models, what can I do with them ? Barely nothing, since sharing them publicly will bring me into trouble, and advertise that with other clients is probably not a good idea to get their confidence. Since these models carry the star wars design language, I’ll probably won’t be able to reuse something from them on say Wall-E 2 ? All I can see from that is trouble…

The only thing that I can copy and reuse is kinda generic stuff, like textures, generic kitbash assets, very simple props. But since they are generic, probably the company bought them in the first place, or it’s obviously not the core value of the company.

To me that’s part of the life, artist doing that obviously play with their career, it’s a small word and I’m sure many are aware of that.

Do you have some clear example where a company was stolen and that cause real trouble to the company ?

If I had to “secure” a part of a company assets, I’ll make that artists can only access projects they work on, and if asset database really got a value, then either you have someone in charge of managing the database. Or you make like you can always just download one asset at a time :
Like with say blendswap : you can browse models, and download some of them, but you can’t copy all the models at once. So no-one is able to rip the whole database at least.

2 Likes

Hmm… i don’t really understand this… i someone like in the RCS article hires people without any restriction/ security measurements in the IT environment… then you missed your obligation to protect your work…

Why should blender be responsible to do something about it… ??

Sometime i also wonder… why something should be solved by somewhat when there are already solutions for this… here:
…different user accounts with different reading rights for different folders/files… (in unix… right from the start, in windows: since NT… 1993)

It seems nowadays people tend to reinvent the wheel for everything… (…wait a have an app for this…)

Let me tell you: this i-can-do-(everything)-better philosophy produce wrong solutions… ignoring years of knowledge of other people…

Giving totall access to short time employees… :crazy_face:
1 Like

Thank you!
In fact, I have an example from life, but it is more about the artist than the company.

I work in the ritual sphere, an artist-designer. I’ll tell you about this case, because the company is not interested in it.

In my country, every artist has his own database of materials to work with.

At that time I was quitting and it was my last day when a replacement person came and sat down at my computer. While I was working on the latest granite projects to close the tails, this new person leaked all the main base I had worked out. It’s good that I had spare resources, but even in that place there were my personal achievements, they do not necessarily relate to blender, these are different types of files related to work.

As a result, quite by accident it turned out to drive this person from the working computer, after which I discovered this incident with a flash drive. He leaked one of my database of files and developments without asking or saying a word.

This area is very difficult in this regard, but there are cases when communities openly distribute files, ready-made images, textures, etc., if this is a trusted community, in such a case they have their own methods in social networks, personal encrypted correspondence or Google drive . But that’s not the problem…

Since I came up with a project for reflection, I will try to relate to it. For example, we have a company for 3D design of military parts, not even a company, but a whole factory! In a staff contract, the disclosure of information and the theft of data is of course prohibited. (I don’t know how it is in other countries, but in my connection to the CNC, it does not have the Internet and a local network, although for example on Sinumeric systems with Windows, there is a password-protected file change lock system for senior technical staff.) Basically, this is used to ensure that there are no accidental changes and deviations from the technical process.

So, what prevents any of the operators from picking up these files? nothing. And this seems to be a multifactorial problem, because not all programs deal with encryption. In this case, of course, it is difficult to follow everything, but corporate software tries to take this into account and synchronize with the main software and equipment.

Hence, since Blender will start full competition, after the development reaches texturing, corporate parties can use it to its full potential. Although I know that there are already companies that are doing this, moreover, for a long time and not in number in the singular. But still, I’m talking about the professional direction, and security issues.

Does it make sense to do such commercial integrations?
After all, there is one more fact, programs in some cases created their own formats, just used for such purposes, otherwise they cannot be opened. It was impossible to open 3ds, but universal ones appeared. Roughly speaking, this can also be some kind of protection, but there is no protection among your files yet anywhere. And I think that would be an interesting innovation.
Or I’m wrong?

And so, there is always a factor of erroneous trust in a person. In the sense that you can trust a person who cannot be trusted. Hence the organization must be dry to all.

Perhaps the problem is that I do not know how it is done by other methods, as in the example above, an example about remote access, but so far I have not seen simple companies or individual entrepreneurs who can afford this.

As for Star Wars:
Fortunately or unfortunately, stocks accept slightly modified models. It doesn’t cost you anything to add a skeleton to Darth, for example, and sell it. You can also change the grid in 3 clicks. As a result, you will sell the company’s property on stocks practically without doing anything. Such a situation will be very important for studios of miniatures and collectible sculptures. There are various schemes, you can buy a sculpture and make a scan, or you can be an employee who changes the grid a little, and adds one extra hair and says that it is a copy, and then sells it. There is an option when it is not allowed. But these are all personal choices.

Perhaps the question concerns more morality …? It is necessary or not, and only then decide whether to do it.

We all know about flooding the market with free models that make for rankings, but this is not done through analysis, and some sales for freelancers become impossible. Also because of such leaks … Why should I buy an author’s model for $ 50, when the one who (If you can say “Stole”) gives it away for free?

I don’t know, I find it difficult to think with one head, I need more options for thinking.

1 Like

Yes, these protections are available, I agree.
But, how can you limit the creation, saving of the file. without limiting the rest, in any way!
And blender is mainly used by artists and enthusiasts, they are far from such a security topic, for example, it’s problematic for me to install a video driver on Linux))

From a practical point of view, there are really just two solutions in my opinion. Either give them remote access or use a file system (as suggested by others) which restricts the access to the files.
Having something like that built into Blender doesn’t make sense in my opinion.

2 Likes

Do you know what it looks like structurally, in a customized way?
For example:

  • Leave internet access
  • Leave access for the shared asset
  • Leave the ability to edit and create new files

Am I understanding your diagram correctly?

  • Internet (limited to blocking network resources, such as Google Drive)
  • Shared Asset(Restricted by system, system administrator) What options are available?

I know:

  • Restriction on folders, subfolders and files.
  • User rights (Full access, change, read and execute, content list, read, write, delete, change permissions and ownership, attributes.)

In principle, this may be enough …
But what if an employee with his own equipment, PC, laptop? - This is the level of system administration, local network. Unfortunately, I don’t know what kind of restrictions there might be in this form.

There are some other options that are capable of prohibiting in the Windows registry, for example, the use of USB, DVD drives for a specific account.

I can say. that standard OS approaches are not enough, you can either make the rights of a certain folder, file, or limit the capabilities of an account, a user.

  • I am confused by the fact that it is impossible to allow reading, while prohibiting writing and creating.

But this is a more complex topic, system administration, which is far, for example, for an ordinary user, let’s agree that the topic of security concerns not only corporations.

Maybe it would be better to take a conditional working environment, in the form of folders?

For example:

  • Asset (Divide into many thematic subfolders, for example asset\year\date\project\files)
    It seems to me that this should be enough for a company that appreciates the time and costs of unnecessary operations.

How, for example, can you do in this case? So that every scene made would work like an Asset for all employees? It’s like a big database.

It is possible to separate each into personal (Restricted) folders and local machines, but you will not be able to secure an Asset if reading, creating and editing is allowed. Or this is done by a separate person who has access to everything, a sort of “Sorting Asset”.

Damn, I don’t seem to know.

You can easily do that in Linux.

1 Like

Encrypting files to try and stop bad actors is a lot like putting a Internet filterer on a teenager’s computer- it works great when you’re in the room, as soon as you leave they’re typing in your password and turning it off, or using a VPN to bypass it, or logging into an admin account you don’t know about. It’s too low-level and too vulnerable. The kind of security you’re talking about needs to be a lot higher than file-level; it needs to be system level to be effective. That is to say, even if someone can read sensitive files, they can’t do anything about it because of system level restrictions. Remember that the most effective security works even when the bad actor knows the key to break it :slight_smile:

3 Likes

There are also writing rights… for different users and folder/files…

The thing is the IT has to setup this and an artist just uses it…

Using artists as security specialists is the that thing of twisted thinking i was talking about…

There are specialist for every area… don’t reinvent the wheel…

1 Like

You don’t, you limit and control where you can save the file, who has access to it and the overall IT environment for both hardware and software.

I’m more familiar with Windows then Linux, but using various admin tools like Active Directory or Windows terminal services it is possible to lock down systems a fair bit and even remove main PC hardware boxes from peoples desks.

Can’t put in a USB flash drive if there’s no actual USB ports to plug it in.

With proxy servers and the like any company has total control over Internet access, from none at all, to logging all activity against each user login to just whitelisting the sites that someone can access (based on their login) and blocking everything else.

So yeah, as others have said, I don’t see it as a Blender issue, just like its not a Word issue to stop people from copying and saving documents.

It’s an IT security issue and the company needs to decide how to setup and manage their systems and if the cost is worth it, vs not doing so.

It is clearly done in the industry, I mean Maya doesn’t have encrypted files, etc but it’s not like you see copies of the latest Avatar or Marvel 3D models leaking out of Weta, ILM, etc. So it’s all a controlled environment, with logging/monitoring. Meaning even if someone tried or did run away with some files, they get caught, sued and never work in the industry again…

2 Likes

Maybe it will be funny, but I can’t work in Linux))

And the permissions and rights in Linux and Windows are the same. Otherwise, the SAMBA server would not work, synchronizing the flow.

Maybe I don’t understand, maybe you.

But by limiting a file or folder from reading, editing, you automatically forbid the user to use Asset files, or create new ones, because he is limited, and he will not be able to open, edit, save them to this folder. But! At the same time, he must have permission to save, edit and read, because this is necessary for work. Without this, he will not be able to work in the blender, or rather save his object, scene, file, while the blender can start. (It will also not be possible to make a log) you give access to both copying and deleting, etc., because the blender does not have settings for restrictions on export and save operations. And the deletion protection method is a copy reservation.

Yes, of course in blender the save operation must be 100%! But, you need to limit the location of this save, possibly settings. Here is the difficulty I see. If you allow access to a client with a configured export restriction, he simply will not be able to do this, or only to a certain directory, not otherwise.

In some cases limited by the system, you can make a copy using standard operations using a blender.

In general, there are a lot of dependencies in the OS security settings (For example, by selecting the “Change” permission, you open several items at once, and these dependencies cannot work separately, they can be interconnected), so I thought about a protected file format, let’s call it . blendsc, in it you can restrict user actions, for example. if the asset is contained in one file, then bind the export operation only to it, etc.
Yes! By the way, as far as I know, there is no such operation, so that you can export to the desired .blend file, you can do this by “append” to the current scene, or by importing other formats, and also only to the scene. (Correct I could be wrong)

So what’s the idea, by opening .blendsc you can’t re-save its contents without specific criteria for doing so. Or something like that. I have not fully thought through the options, so it is interesting to discuss, to think about it.

The protected .blendsc file format can work in two directions, both for the personality of a freelance artist, and for indie companies, and other activities.

This format is something like, blocked for third-party editing of information about authorship, as in Crete and the like. But at the same time, it has configured restrictions on operations or owners who can do this, maybe this can be done using Google login. Don’t know…

But that seems like an interesting approach, no?

and again, don’t forget that this is a feature not only for corporations, but also for your personal works.

Seems like a tricky topic…