> This should be a critical part of the standard The standard is not at all concerned with the browser-CDM interaction, sadly. And yes, that's a major issue w

> This should be a critical part of the standard The standard is not at all concerned with the browser-CDM interaction, sadly. And yes, that's a major issue with the standard. We (Mozilla) brought it up repeatedly when the standard was being developed, because it causes precisely the issues you describe, and basically got ignored. Microsoft, Google, and Netflix (the editors for the standard) simply didn't see this as a problem. Now in practice, Mozilla aims to give the CDM as little information as possible, because we think it's the right thing to do. But nothing in the EME standard requires us to do that, and I can't tell you what other browsers do with their CDMs. > It means that users are no longer free from browser-discrimination That's correct. You never _really_ were, by the way: sites can and do use Modernizr-like testing instead of UA string sniffing to detect what browser you're running, so the only way to avoid being discriminated against by a site that really wants to discriminate is to have a browser which responds the same way an "approved" browser does to all API calls... Doable, but in practice requires using an "approved" browser with some tweaks that are invisible to the site.