18 ms·

Tim Berners-Lee just gave us an opening to stop DRM in Web standards

318 points by mynameislegion 10y ago

wooptoo 10y ago
That's a bit disheartening. Instead of having a basic standard to start with, we will now have none. The issue that FSF and others appears to have is with the Content Decryption Module which is a binary blob at the moment. Standardising/opening up the CDM spec could have been done afterwards. If the W3C were a bit sneakier they could have played a bait-and-switch game on the content providers and push for a standard/opensource CDM at some point. Why couldn't there be an open-source CDM?
- cyphar 10y ago
  > Why couldn't there be an open-source CDM? You could have an "open source" implementation. But you couldn't have an effective free software implementation, because it wouldn't be possible for it to be an effective DRM measure. If you have free software DRM, what stops a user from removing the DRM components (hint: nothing)?
  - wooptoo 10y ago
    > what stops a user from removing the DRM components I think inertia and convenience. Casual users won't hack around trying to rip Netflix when they have already paid for it. Also since services like Netflix are in the cloud they allow for viewing from multiple devices and other benefits (remembering where you left off, etc). Sure, there might be some savvy developers out there that might put out a custom build of Chromium with a stream ripper plugin. But that still means that some users have to pay for content.
    - cyphar 10y ago
      > I think inertia and convenience. I'm talking about a free software DRM implementation -- where users have been explicitly given the freedom to remove the DRM. Sure, not everyone will modify their copy of Chromium but once a single developer does and creates a fork of it, that's all you need (and that's why freedoms #2 and #3 are so important). The reason I pointed that out is because wishing for a "free software DRM implementation" is a bit silly, because having a free software implementation contradicts the whole purpose of DRM (which is why we should reject DRM as a concept, not barter with DRM proponents about what the licensing of the DRM binary blobs should be).
  - DiabloD3 10y ago
    Nothing will EVER stop it. DRM is a scam, nothing more, nothing less. As long as human beings have access to the data that they are (legally) allowed to have access to, unencrypted data will exist and will be pirated. Steam solved the DRM issue eons ago: become the best place to get something, and people will flock to you to get it.
    - gcp 10y ago
      There's still significant pirating of games despite the existence of Steam.
      - wooptoo 10y ago
        I'd say much less than it used to be. Those emails saying "An item from your wishlist is now on sale for $9" is highly effective.
        gcp 10y ago
        Oh, not arguing Steam is an awesome tool in generating more revenue for the publishers. But it didn't "solve" the DRM problem. It mostly showed that it's a red herring. (Steam itself is also DRM, but AFAIK easily broken so more perfunctory).
        wtetzner 10y ago
        I guess it depends on what the DRM problem really is. If the problem is that companies don't make enough money because of pirating, then Steam did solve the problem, because they make enough money despite pirating.
        DiabloD3 10y ago
        Now only if I'd get an email for Doom 4, and the price is $15 or less, I'd totally be all over that.
      - antocv 10y ago
        You could add to the first claim "offer a good product and pirating will stop", with "lower economic inequality", so despite Steam being nice and all - pirating exist where its still too expensive to access their games. It would be nice if the pricing of Steam was adapted to the economic conditions of the country - but that then has problems of rich country users would probably find proxies in poor countries. Its just not fair for someone making/having enough cash to buy Steam games with pocket change, while another large group of people have to plan and save for months to get same access, of course they will find other methods.
  - gsnedders 10y ago
    You can, however, make the binary blobs smaller than they currently are, and make a larger part of the code path free.
    - cyphar 10y ago
      DRM as a concept is incompatible with free software. Having "a majority of the code path free" is not a meaningful or useful statement -- a piece of software that has proprietary components in it makes the entire piece of software proprietary, especially if removing the proprietary component removes critical features of the software.
- belorn 10y ago
  What they should do is to create a standard open source license that all DRM must use. Instead, we now have none. Current DRM just pick their own license and that means many are incompatible. Some is binary blobs, some aren't. Wouldn't it be better for everyone involved if there were a standard? There is a limit to what standards can and should do. At some point it will do more harm than good, and that point is basically reached when there is no common ground. DRM is as warmly welcomed in a free software ecosystem as forced open sourcing would be for drm producers.
  - gcp 10y ago
    There's DRM (actually used by someone) that isn't a binary blob? Where?
    - belorn 10y ago
      Some publishers just use flash to manage digital media, and there is free FLOSS version of flash. It is not very effective as copy protection, but drm is not the same as copy protection as Denuvo often points out. If one look outside of the webrowser, there is also tools like tmp-tools, as linux have tpm support for quite a time now.
      - gcp 10y ago
        there is free FLOSS version of flash Without the DRM parts. If they're emulated, they'll be ineffective. I hope it's obvious why? I don't know what tmp-tools are, and Google doesn't turn up anything.
        belorn 10y ago
        As copy protection they are either ineffective or, to use a security term, broken. Some companies care about that and will not use it, while others will (know several examples, like the Swedish national TV, which has broken copy protection but don't care/mind). This is why such standard would be a poor choice, and having no standard is better when there a well established understanding that a significant portion of implementation will be standard incompatible. EME is bad because a significant portion of website will not work universally on all machines. The current system is better, and all EME is doing is causing is placing the DRM battlegrounds on W3C rather than making innovation for the web. tmp-tools is libraries/tools to talk to TPM's on a linux system. Using them, one can implement concepts like trusted boot, and there were/is a patch to grub for that.
- Manishearth 10y ago
  Speccing this could never have gotten us an open source implementation. The spec was for the API, the blobs would still be licensed and proprietary. If you have an open source DRM module then the DRM can be circumvented by an open source program, which is sort of against the point of the DRM.
gcp 10y ago
As others have pointed out, this amounts to nothing. At worst there'll be no standard, at best there'll be a standard not under W3C control. That being said, Netflix was a big pusher for EME, as far as I know not because they wanted it, but because the studios they license from demand DRM. Yet, they seem to have lost most of their "movie studio" catalogue and are now focusing on originals. Netflix guys, what about allowing us to see the originals even if we don't have a CDM installed? That would kill DRM/EME faster than hollow FSF & EFF victories. FSF/EFF guys, doesn't this sound like a more promising campaign to you?
- AimHere 10y ago
  > At worst there'll be no standard, at best there'll be a standard not under W3C control Wrong way around. From the anti-DRM POV, the best case is no standard, since that likely turns DRM web content platforms into an ugly battleground where multiple competing proprietary companies use horrendous tactics to fight over user share and platform dominance. All sorts of third party browser plugins will be needed, with the resulting mess of upgrades and incompatibilities and platform dependencies, and the whole world just ends up hating the whole mess and goes back to the free internet. Think in terms of Flash vs Silverlight vs Java applets all being superceded by the considerably less awful HTML5. The point is to make DRM-afflicted content into as bad a product as possible. Having a standard for DRM is only a good thing if those against it have already admitted defeat. The worry is if the content providers get together and make a standard outside of the W3C, and DRM content becomes a usable product without any consortium input.
  - gcp 10y ago
    This is an interesting POV, which I hadn't considered. There are more outcomes possible than the one you suggested though. It's possible for one DRM standard to win out over the others, thereby entrenching one single proprietary, closed, intrusive and potentially patented solution into something that just has to be supported. 15 years ago we called this Flash. We've still not gotten entirely rid of it. Maybe it's prudent to avoid a repetition of that situation.
    - 10y ago
Jaruzel 10y ago
Unfortunately, it's peoples very nature to avoid paying for things if they don't have to. Whereas I don't support the wholesale DRMing of everything, I do support the Content Creators right to be remunerated for their work. Without DRM, people will steal stuff without regard for the creators survival. This was seen most visible in the Pop Music industry. Piracy was so rife, that indie musicians were considered too big a risk for the labels, who turned to low-risk-low-cost 'music factory' style churning out of the same low quality pap that the popular charts is now peppered with. If we don't protect artists (by this I mean, musicians, game designers, visual artists, program makers etc.) from the people trying to steal from them, there will be no quality content going forward, and the only form of entertainment will come from the mega-corps trying to peddle their wares in the guise of ad-laden media. So, in my view, a standard cross-platform secure DRM model for the web is required. If you want to consume it, you should be prepared to pay for it.
- thomasahle 10y ago
  Why does it matter if Netflix or others lock their content, when it is already available pirated elsewhere? People still pay for Netflix even though they could watch everything for free.
- pedrocr 10y ago
  > So, in my view, a standard cross-platform secure DRM model for the web is required. If you want to consume it, you should be prepared to pay for it. These are completely orthogonal to one another. People pay for content when they can get a good service at a fair price. For the longest time it was much easier to torrent movies and shows than to try and navigate through the cesspool of TV scheduling, ads, etc. Netflix fixed that and now people pay for content. The same happened with music. DRM solves nothing as it only takes one determined person to break it and then everyone else gets a great experience. Meanwhile all your paying customers have to suffer through a poor experience thanks to DRM. It's self-defeating.
  - Jaruzel 10y ago
    > Meanwhile all your paying customers have to suffer through a poor experience thanks to DRM. No, that's all thanks to rubbish DRM. You are confusing the concept of DRM with the implementation. Good DRM should be seamless and no-different (to the end user) to non-DRM content - it's this area that is failing, and why the current failure to settle on a good DRM standard is resulting in so many badly implemented proprietary systems.
eveningcoffee 10y ago
Everyone who is ignorant towards the standard DRM in web browsers does not see the forest behind the trees. It does not stop with movies or music. If DRM is deeply integrated into the web then everything will get affected by it. Already today some publisher go to great lengths to try to disturb people from copying simple text and images. It will get only worse. Currently the openness of the web has been very beneficial to the people willing to make an effort to learn the web technologies. I think that this has opened the field for many talented people. You can just inspect the page and try to learn how it is made by reverse engineering it. This will go away and you will get the inaccessible binary blob instead.
- gcp 10y ago
  This is all true, but what has it got to do with the W3C approving the standard or not? The content publishers and the browser makers are severely intermingled and often the same company. (Google, Apple, "Netflix HD only on Edge") We don't even need to pretend Firefox has any relevance in this particular space. If Google wants to push SPDY or HTTP2 or a DRM technology through, they can just do so through combined browser and YouTube/Gmail/Google Play/Android/Google Docs marketshare. Similar things apply to the iOS and Windows ecosystems. The W3C exists as place for these companies to work out interoperability standards. They have no other incentive to attend. If the W3C gets in the way of that, what does it matter? They can interoperate or not. There can be a standard or not. DRM will be there anyway. Be it Flash, be it something else.
  - eveningcoffee 10y ago
    We don't even need to pretend Firefox has any relevance And this is a collective fault of many ignorant persons also in this forum who more than often have suggest people to use Chrome. I think that Chrome has gained much support thanks to the wide spread ignorance about the implications.
    - gcp 10y ago
      I wouldn't say those people were "ignorant". Things like YouTube, Google Docs, most Google properties work better in Chrome. This isn't always intentional, even. Google can control both ends of the pipe, which means whenever they make big changes Chrome users will have a better experience. They pushed ahead there with MSE, codec support (VP9), SPDY, HTTP/2, etc and other browsers had to catch up. If other browsers were ahead in some areas, it didn't matter, because the content side didn't support it. Sites are designed and optimized in Chrome first and foremost, so Chrome never risks looking slow. Similar things apply to Safari on iOS, or Edge on Windows. The problem in my mind is that by having the same parties sit on both ends of this story, it's inevitable the middle man (that could be a leverage against DRM) gets pushed out. It's very, very hard to explain to the majority of users that they have to accept short term pain to avoid an outcome that is much worse for them. Ask any politician. But we don't even need to kill the web to get there (pushing out any middlemen). We have native apps! Nobody is complaining their Android or iOS phone has DRM, do they?
INTPenis 10y ago
Pardon my cynicism but there is no stopping this. Money talks, money is power, activists lack both the power and organisation of large corporations. I foresee a near future where only a few in society will be able to use the internet safely. There will be subcultures, small segregated pockets of people who refuse the big corporate alternatives on the internet. We're already seeing this today, think about it. I'm speaking from a Swedish perspective but when piracy on the www was relatively new in the 90s you'd go to "your guy" with the CD-burners and they would give you the movie, game, software you needed. Only a few people knew enough to keep up with the trends, the BBS, the FTP sites and the newsgroups. Though there was little to none legal problems there were instead technical problems to piracy. Then we had the piracy golden age, from about 98 to 2015, or today even. When everyone and their grandmother pirated. It was so easy, and torrents made it even easier. But now the biggest ISP in Sweden has started handing over personal information of their subscribers to foreign companies who are sending monetary demands to the customers if their IP is found on trackers. So instead of being taken to court, just pay the money right? That's just the start, it will only get worse because corporations have all the power. But let's look at another example less sinister than piracy. Let's look at simple tracking and web security. Even there you have to be relatively computer savvy to keep up with the new tools, Adblock is out, uBlock is in, Noscript author is under fire, alternatives are often hosted on github. See what I mean? Safe web browsing is being restricted to a few people savvy enough, or interested enough, to keep up with that scene. So already, today we're seeing what the future holds for the internet. Any privacy conscious, safe browsing will be pushed to minority subcultures using different platforms, tools and networks than the rest of the population. The internet will be just another TV or Radio, with indie broadcasters fighting to remain free in a vast sea of big corporations. We'll most definitely always have open source browsers but the question is how well these browsers will support the new DRM internet that I foresee in our futures. So pardon my cynicism when I see no positive outcome for DRM on the web. I see instead a majority of content under DRM protection, some of it being copied by a small minority in society and spread through other smaller networks of people who refuse the mainstream web standards. How this is achieved is just a technicality. It is inevitable because there's money in it and as long as there's money in it corporations will pour money into lobbying to change the rules in their favor.
- 10y ago
oliv__ 10y ago
"Defective by Design" Sounds like pretty much everything that's manufactured these days...
- lucb1e 10y ago
  Dishonest by design I'd say. Many many vendors do not provide security updates[1], lock down their platform physically[2] and digitally[3], do not provide customer service[4], or make things that are intended to break before you may expect. There is 2-year warranty for electronics in the EU, but good luck suing some big American corp for your 1 year 11 month old device. [1] IoT & Android comes to mind. [2] Funny new screws in every iPhone come to mind, but of course there are a thousand product categories where the same happens. [3] DRM in any kind of way. I would personally count all closed source software in this category, but as a software engineer who might like to tweak a feature in the source, I have a different perspective on what "locked down software" means. [4] Google for any product, Microsoft for Windows, and many other such companies. Either they have a big fortune to not care about the couple of customers that run into trouble (e.g. Google), or they think it's not their responsibility since they don't sell directly to customers (Microsoft).
lucb1e 10y ago
> DRM's dark history — from the Sony rootkit malware to draconian anti-circumvention laws — demonstrates that integrating it into Web standards would be nothing but bad for Web users. This is where I get scared. What if DRM does not become a web standard? What is the alternative that companies will want to use instead? That is for me the only reason why standardization might potentially be a good thing. Not because DRM is good, but because the alternative might be worse. Everything in the past has been broken anyway. From CSS to AACS to HDCP[1]. I was hoping Firefox (and perhaps Chromium, but Google would probably not be so kind as to open source that part of the code) would have the DRM code built in so that we can spoof the whole thing with simple modifications. Better than having to reverse engineer Sony malware. [1] https://en.wikipedia.org/wiki/Illegal_number https://en.wikipedia.org/wiki/Illegal_number
- gsnedders 10y ago
  > From CSS to AACS to HDCP[1]. I was hoping Firefox (and perhaps Chromium, but Google would probably not be so kind as to open source that part of the code) would have the DRM code built in so that we can spoof the whole thing with simple modifications. That fails to fulfil the requirements of pretty much any level of DRM, and hence such an implementation would be totally ignored and unused, and sites would continue to use Flash in preference to it. (I wish I could find the document Google published last year about the different levels of DRM the industry has been concluded need to exist for them to use; alas, I cannot!)
  - lucb1e 10y ago
    > such an implementation would be totally ignored and unused Yeah I am a bit scared of that too, but then what would be the point of standardization in the first place?
    - gsnedders 10y ago
      Primarily to have a standard API to determine what DRM schemes the UA supports. A less important part of it is to avoid a different code-path for each different DRM scheme each with its own API.
micro_softy 10y ago
Avoiding DRM is easy. Avoid corporate-sponsored browsers. Writing programs that download files is not beyond the capabilities of average programmers. And internet users have ample access to open file formats and source code to read and write them. Who controls media formats? Who controls media players? "Browser"? What is that? A program to "browse" hypertext has evolved into something with far more functionality than is actually required for digesting media. As this complexity grows the notion of the "browser" will continue to be used to the greater advantage of corporations engaged in commerce, not users. Proprietary browsers, or ones that are too complex for ordinary programmers to compile from source, can be the equivalent of proprietary media formats and proprietary media players, in effect. The greatest opportunity to avoid DRM is in choice, not steering committees. Choice, as in, choice of what software to use. And that includes "browsers". Think outside the browser. Thank you.
contingencies 10y ago
Vote with your money. Don't buy Apple or Google devices, don't pay for Netflix or similar DRM streaming systems, don't buy Kindle books, don't buy Steam games. Buy unlocked media only, and don't forget to create some of your own.
- givinguflac 10y ago
  I wouldn't ever buy content I will own with DRM, but if you think you'll ever see streaming without DRM you're crazy. Personally I've done my fair share of pirating for various reasons, and I think streaming services are the ONLY reasonable use case for DRM. You aren't actually purchasing content.
  - contingencies 10y ago
    Streaming without DRM comes pre-installed on TVs here in China, and there are many torrent-based solutions as well.
- gok 10y ago
  So basically, avoid all entertainment.
- clarry 10y ago
  > Don't buy Apple or Google devices Never did > don't pay for Netflix or similar DRM streaming systems Never did > don't buy Kindle books Never did > don't buy Steam games Never did > don't forget to create some of your own. Working on it. But shit like this is still happening all the time, despite "voting" throughout my life. I don't think such voting is effective.
pc2g4d 10y ago
I'm just not so sure the EME is so horrible. If companies want to deliver their content encrypted then they will do so.
oldmanjay 10y ago
The politics of desire always make for fascinating attempts at rationalization
Waterluvian 10y ago
Isn't this just an arms race that they can never win? Regardless of source, encryption, format, etc. If a frame of a movie eventually makes it to my video card's buffer, I can get at it, right? There is no end-to-end encryption from source into my brain. I can only see this just being a colossal inconvenience for users, developers, and many many innocent applications.
- mordocai 10y ago
  The end game would be decrypting it in the display device (better have a movie conglomerate approved video card and display device so everything supports the drm!) + one of the many solutions lately that can cause recording devices to (voluntarily at the device level, not at the user level) turn off. Then of course you just use a non-broken recording device and record it but it'd be potentially very hard to get a purely digital signal out of a system like that (unless they mess it up, which they will). And in the end pirates will continue getting to it an alternative way or cracking the drm and as you say, users are the ones inconvenienced.
throw2016 10y ago
I think DRM is anti culture. Human history has been about sharing. We are a product of the whole. Cultural wealth has been passed down hundreds of years. Now the story tellers and singers do not want you to repeat their stuff, which put in perspective is not a very cultural thing to do. And the only reason they can do this is because interests can congregate and technology can be abused but it seems morally and ethically questionable. You are not stealing anything, you are watching or listening to a product of our culture. You do not take anything away from anyone. Its just a small period of 70 years before the internet when mass media and content creators could colloborate to 'manufacture trends', hits and disproportionate wealth. Before that artists went broke and risked everything just to get their stuff published and out to readers and viewers. Obviously this is not how it should be but the whole 'jetset star lifestyle' may not always be possible simply because you are an artist. The problem is now that kind of 'trend manufacturing' is much harder to pull off. But the entire industry from studios to artists have got throughly spoilt, got used to those disproportionate returns and are now throwing all their toys out of the pram. Artists create but the rest of the world is also busy creating stuff. Engineers, industrial designers, scientists, programmers, eveyone is creating stuff. Can anyone just be 'entitled' to extraordinary wealth just because they create. Maybe its their cost structures, business models and expectations that need to change. DRM is just a tantrum backed by money, its rent seeking of the worst kind and our democractic institutions and systems are so compromised by special interests they will continue to get their way.
grogenaut 10y ago
EDIT: I'm not trying to bag on them, I just think they need to work on their messaging if they want to be effective: That website seems about as in touch with people not of the same mindset as the back pages of norml's website (once you got past the parts written by a pr person). It's got a rotating banner to "cancel netflix" which links to a 2013 post about how netflix will make you use only certain browsers. Makes the site either seem disused... or "tinfoil" as I think most consumers love netflix. (note I only used norml as an example because their site used to (and may still be) well articulated argument on the front which quickly devolves into what many people would see as weakly argued reasons for letting me get high. it's why, in any movement, you put your articulate people out front even if they're not the real driver).
ubersoldat2k7 10y ago
There seems to be lots of confusion of what EME is because people bring up images, text and games. First of all, EME is targeted to video and, to less extent, music streaming. Streaming video content to web browsers is, currently, a mess. There are many DRM schemes and each does its own crazy shit to try and make it work on everyone's browser. It's also expensive. So expensive that only big companies will target big platforms. Also, EME doesn't affect only web browsers, it also affects SmartTVs which are limited to a few DRM products. What EME and CENC try to achieve is to add simplicity to this process and for open source products to be able to compete with closed source ones. Even small DRM products are moving on this direction because it's impossible for them to target all platforms. On this regard, even an open source DRM scheme could be achieved and compete. DRM, EME and CENC will happen, and this only hurts open source products like Linux and Firefox. But it will happen.

318 points by mynameislegion 10y ago

That's a bit disheartening. Instead of having a basic standard to start with, we will now have none. The issue that FSF and others appears to have is with the Content Decryption Module which is a binary blob at the moment. Standardising/opening up the CDM spec could have been done afterwards. If the W3C were a bit sneakier they could have played a bait-and-switch game on the content providers and push for a standard/opensource CDM at some point. Why couldn't there be an open-source CDM?

cyphar 10y ago
> Why couldn't there be an open-source CDM? You could have an "open source" implementation. But you couldn't have an effective free software implementation, because it wouldn't be possible for it to be an effective DRM measure. If you have free software DRM, what stops a user from removing the DRM components (hint: nothing)?
- wooptoo 10y ago
  > what stops a user from removing the DRM components I think inertia and convenience. Casual users won't hack around trying to rip Netflix when they have already paid for it. Also since services like Netflix are in the cloud they allow for viewing from multiple devices and other benefits (remembering where you left off, etc). Sure, there might be some savvy developers out there that might put out a custom build of Chromium with a stream ripper plugin. But that still means that some users have to pay for content.
  - cyphar 10y ago
    > I think inertia and convenience. I'm talking about a free software DRM implementation -- where users have been explicitly given the freedom to remove the DRM. Sure, not everyone will modify their copy of Chromium but once a single developer does and creates a fork of it, that's all you need (and that's why freedoms #2 and #3 are so important). The reason I pointed that out is because wishing for a "free software DRM implementation" is a bit silly, because having a free software implementation contradicts the whole purpose of DRM (which is why we should reject DRM as a concept, not barter with DRM proponents about what the licensing of the DRM binary blobs should be).
- DiabloD3 10y ago
  Nothing will EVER stop it. DRM is a scam, nothing more, nothing less. As long as human beings have access to the data that they are (legally) allowed to have access to, unencrypted data will exist and will be pirated. Steam solved the DRM issue eons ago: become the best place to get something, and people will flock to you to get it.
  - gcp 10y ago
    There's still significant pirating of games despite the existence of Steam.
    - wooptoo 10y ago
      I'd say much less than it used to be. Those emails saying "An item from your wishlist is now on sale for $9" is highly effective.
      - gcp 10y ago
        Oh, not arguing Steam is an awesome tool in generating more revenue for the publishers. But it didn't "solve" the DRM problem. It mostly showed that it's a red herring. (Steam itself is also DRM, but AFAIK easily broken so more perfunctory).
        wtetzner 10y ago
        I guess it depends on what the DRM problem really is. If the problem is that companies don't make enough money because of pirating, then Steam did solve the problem, because they make enough money despite pirating.
      - DiabloD3 10y ago
        Now only if I'd get an email for Doom 4, and the price is $15 or less, I'd totally be all over that.
    - antocv 10y ago
      You could add to the first claim "offer a good product and pirating will stop", with "lower economic inequality", so despite Steam being nice and all - pirating exist where its still too expensive to access their games. It would be nice if the pricing of Steam was adapted to the economic conditions of the country - but that then has problems of rich country users would probably find proxies in poor countries. Its just not fair for someone making/having enough cash to buy Steam games with pocket change, while another large group of people have to plan and save for months to get same access, of course they will find other methods.
- gsnedders 10y ago
  You can, however, make the binary blobs smaller than they currently are, and make a larger part of the code path free.
  - cyphar 10y ago
    DRM as a concept is incompatible with free software. Having "a majority of the code path free" is not a meaningful or useful statement -- a piece of software that has proprietary components in it makes the entire piece of software proprietary, especially if removing the proprietary component removes critical features of the software.
belorn 10y ago
What they should do is to create a standard open source license that all DRM must use. Instead, we now have none. Current DRM just pick their own license and that means many are incompatible. Some is binary blobs, some aren't. Wouldn't it be better for everyone involved if there were a standard? There is a limit to what standards can and should do. At some point it will do more harm than good, and that point is basically reached when there is no common ground. DRM is as warmly welcomed in a free software ecosystem as forced open sourcing would be for drm producers.
- gcp 10y ago
  There's DRM (actually used by someone) that isn't a binary blob? Where?
  - belorn 10y ago
    Some publishers just use flash to manage digital media, and there is free FLOSS version of flash. It is not very effective as copy protection, but drm is not the same as copy protection as Denuvo often points out. If one look outside of the webrowser, there is also tools like tmp-tools, as linux have tpm support for quite a time now.
    - gcp 10y ago
      there is free FLOSS version of flash Without the DRM parts. If they're emulated, they'll be ineffective. I hope it's obvious why? I don't know what tmp-tools are, and Google doesn't turn up anything.
      - belorn 10y ago
        As copy protection they are either ineffective or, to use a security term, broken. Some companies care about that and will not use it, while others will (know several examples, like the Swedish national TV, which has broken copy protection but don't care/mind). This is why such standard would be a poor choice, and having no standard is better when there a well established understanding that a significant portion of implementation will be standard incompatible. EME is bad because a significant portion of website will not work universally on all machines. The current system is better, and all EME is doing is causing is placing the DRM battlegrounds on W3C rather than making innovation for the web. tmp-tools is libraries/tools to talk to TPM's on a linux system. Using them, one can implement concepts like trusted boot, and there were/is a patch to grub for that.
Manishearth 10y ago
Speccing this could never have gotten us an open source implementation. The spec was for the API, the blobs would still be licensed and proprietary. If you have an open source DRM module then the DRM can be circumvented by an open source program, which is sort of against the point of the DRM.

gcp 10y ago

As others have pointed out, this amounts to nothing. At worst there'll be no standard, at best there'll be a standard not under W3C control. That being said, Netflix was a big pusher for EME, as far as I know not because they wanted it, but because the studios they license from demand DRM. Yet, they seem to have lost most of their "movie studio" catalogue and are now focusing on originals. Netflix guys, what about allowing us to see the originals even if we don't have a CDM installed? That would kill DRM/EME faster than hollow FSF & EFF victories. FSF/EFF guys, doesn't this sound like a more promising campaign to you?

AimHere 10y ago
> At worst there'll be no standard, at best there'll be a standard not under W3C control Wrong way around. From the anti-DRM POV, the best case is no standard, since that likely turns DRM web content platforms into an ugly battleground where multiple competing proprietary companies use horrendous tactics to fight over user share and platform dominance. All sorts of third party browser plugins will be needed, with the resulting mess of upgrades and incompatibilities and platform dependencies, and the whole world just ends up hating the whole mess and goes back to the free internet. Think in terms of Flash vs Silverlight vs Java applets all being superceded by the considerably less awful HTML5. The point is to make DRM-afflicted content into as bad a product as possible. Having a standard for DRM is only a good thing if those against it have already admitted defeat. The worry is if the content providers get together and make a standard outside of the W3C, and DRM content becomes a usable product without any consortium input.
- gcp 10y ago
  This is an interesting POV, which I hadn't considered. There are more outcomes possible than the one you suggested though. It's possible for one DRM standard to win out over the others, thereby entrenching one single proprietary, closed, intrusive and potentially patented solution into something that just has to be supported. 15 years ago we called this Flash. We've still not gotten entirely rid of it. Maybe it's prudent to avoid a repetition of that situation.
  - 10y ago

Jaruzel 10y ago

Unfortunately, it's peoples very nature to avoid paying for things if they don't have to. Whereas I don't support the wholesale DRMing of everything, I do support the Content Creators right to be remunerated for their work. Without DRM, people will steal stuff without regard for the creators survival. This was seen most visible in the Pop Music industry. Piracy was so rife, that indie musicians were considered too big a risk for the labels, who turned to low-risk-low-cost 'music factory' style churning out of the same low quality pap that the popular charts is now peppered with. If we don't protect artists (by this I mean, musicians, game designers, visual artists, program makers etc.) from the people trying to steal from them, there will be no quality content going forward, and the only form of entertainment will come from the mega-corps trying to peddle their wares in the guise of ad-laden media. So, in my view, a standard cross-platform secure DRM model for the web is required. If you want to consume it, you should be prepared to pay for it.

thomasahle 10y ago
Why does it matter if Netflix or others lock their content, when it is already available pirated elsewhere? People still pay for Netflix even though they could watch everything for free.
pedrocr 10y ago
> So, in my view, a standard cross-platform secure DRM model for the web is required. If you want to consume it, you should be prepared to pay for it. These are completely orthogonal to one another. People pay for content when they can get a good service at a fair price. For the longest time it was much easier to torrent movies and shows than to try and navigate through the cesspool of TV scheduling, ads, etc. Netflix fixed that and now people pay for content. The same happened with music. DRM solves nothing as it only takes one determined person to break it and then everyone else gets a great experience. Meanwhile all your paying customers have to suffer through a poor experience thanks to DRM. It's self-defeating.
- Jaruzel 10y ago
  > Meanwhile all your paying customers have to suffer through a poor experience thanks to DRM. No, that's all thanks to rubbish DRM. You are confusing the concept of DRM with the implementation. Good DRM should be seamless and no-different (to the end user) to non-DRM content - it's this area that is failing, and why the current failure to settle on a good DRM standard is resulting in so many badly implemented proprietary systems.

eveningcoffee 10y ago

Everyone who is ignorant towards the standard DRM in web browsers does not see the forest behind the trees. It does not stop with movies or music. If DRM is deeply integrated into the web then everything will get affected by it. Already today some publisher go to great lengths to try to disturb people from copying simple text and images. It will get only worse. Currently the openness of the web has been very beneficial to the people willing to make an effort to learn the web technologies. I think that this has opened the field for many talented people. You can just inspect the page and try to learn how it is made by reverse engineering it. This will go away and you will get the inaccessible binary blob instead.

gcp 10y ago
This is all true, but what has it got to do with the W3C approving the standard or not? The content publishers and the browser makers are severely intermingled and often the same company. (Google, Apple, "Netflix HD only on Edge") We don't even need to pretend Firefox has any relevance in this particular space. If Google wants to push SPDY or HTTP2 or a DRM technology through, they can just do so through combined browser and YouTube/Gmail/Google Play/Android/Google Docs marketshare. Similar things apply to the iOS and Windows ecosystems. The W3C exists as place for these companies to work out interoperability standards. They have no other incentive to attend. If the W3C gets in the way of that, what does it matter? They can interoperate or not. There can be a standard or not. DRM will be there anyway. Be it Flash, be it something else.
- eveningcoffee 10y ago
  We don't even need to pretend Firefox has any relevance And this is a collective fault of many ignorant persons also in this forum who more than often have suggest people to use Chrome. I think that Chrome has gained much support thanks to the wide spread ignorance about the implications.
  - gcp 10y ago
    I wouldn't say those people were "ignorant". Things like YouTube, Google Docs, most Google properties work better in Chrome. This isn't always intentional, even. Google can control both ends of the pipe, which means whenever they make big changes Chrome users will have a better experience. They pushed ahead there with MSE, codec support (VP9), SPDY, HTTP/2, etc and other browsers had to catch up. If other browsers were ahead in some areas, it didn't matter, because the content side didn't support it. Sites are designed and optimized in Chrome first and foremost, so Chrome never risks looking slow. Similar things apply to Safari on iOS, or Edge on Windows. The problem in my mind is that by having the same parties sit on both ends of this story, it's inevitable the middle man (that could be a leverage against DRM) gets pushed out. It's very, very hard to explain to the majority of users that they have to accept short term pain to avoid an outcome that is much worse for them. Ask any politician. But we don't even need to kill the web to get there (pushing out any middlemen). We have native apps! Nobody is complaining their Android or iOS phone has DRM, do they?

INTPenis 10y ago

Pardon my cynicism but there is no stopping this. Money talks, money is power, activists lack both the power and organisation of large corporations. I foresee a near future where only a few in society will be able to use the internet safely. There will be subcultures, small segregated pockets of people who refuse the big corporate alternatives on the internet. We're already seeing this today, think about it. I'm speaking from a Swedish perspective but when piracy on the www was relatively new in the 90s you'd go to "your guy" with the CD-burners and they would give you the movie, game, software you needed. Only a few people knew enough to keep up with the trends, the BBS, the FTP sites and the newsgroups. Though there was little to none legal problems there were instead technical problems to piracy. Then we had the piracy golden age, from about 98 to 2015, or today even. When everyone and their grandmother pirated. It was so easy, and torrents made it even easier. But now the biggest ISP in Sweden has started handing over personal information of their subscribers to foreign companies who are sending monetary demands to the customers if their IP is found on trackers. So instead of being taken to court, just pay the money right? That's just the start, it will only get worse because corporations have all the power. But let's look at another example less sinister than piracy. Let's look at simple tracking and web security. Even there you have to be relatively computer savvy to keep up with the new tools, Adblock is out, uBlock is in, Noscript author is under fire, alternatives are often hosted on github. See what I mean? Safe web browsing is being restricted to a few people savvy enough, or interested enough, to keep up with that scene. So already, today we're seeing what the future holds for the internet. Any privacy conscious, safe browsing will be pushed to minority subcultures using different platforms, tools and networks than the rest of the population. The internet will be just another TV or Radio, with indie broadcasters fighting to remain free in a vast sea of big corporations. We'll most definitely always have open source browsers but the question is how well these browsers will support the new DRM internet that I foresee in our futures. So pardon my cynicism when I see no positive outcome for DRM on the web. I see instead a majority of content under DRM protection, some of it being copied by a small minority in society and spread through other smaller networks of people who refuse the mainstream web standards. How this is achieved is just a technicality. It is inevitable because there's money in it and as long as there's money in it corporations will pour money into lobbying to change the rules in their favor.

10y ago

oliv__ 10y ago

"Defective by Design" Sounds like pretty much everything that's manufactured these days...

lucb1e 10y ago
Dishonest by design I'd say. Many many vendors do not provide security updates[1], lock down their platform physically[2] and digitally[3], do not provide customer service[4], or make things that are intended to break before you may expect. There is 2-year warranty for electronics in the EU, but good luck suing some big American corp for your 1 year 11 month old device. [1] IoT & Android comes to mind. [2] Funny new screws in every iPhone come to mind, but of course there are a thousand product categories where the same happens. [3] DRM in any kind of way. I would personally count all closed source software in this category, but as a software engineer who might like to tweak a feature in the source, I have a different perspective on what "locked down software" means. [4] Google for any product, Microsoft for Windows, and many other such companies. Either they have a big fortune to not care about the couple of customers that run into trouble (e.g. Google), or they think it's not their responsibility since they don't sell directly to customers (Microsoft).

lucb1e 10y ago

> DRM's dark history — from the Sony rootkit malware to draconian anti-circumvention laws — demonstrates that integrating it into Web standards would be nothing but bad for Web users. This is where I get scared. What if DRM does not become a web standard? What is the alternative that companies will want to use instead? That is for me the only reason why standardization might potentially be a good thing. Not because DRM is good, but because the alternative might be worse. Everything in the past has been broken anyway. From CSS to AACS to HDCP[1]. I was hoping Firefox (and perhaps Chromium, but Google would probably not be so kind as to open source that part of the code) would have the DRM code built in so that we can spoof the whole thing with simple modifications. Better than having to reverse engineer Sony malware. [1] https://en.wikipedia.org/wiki/Illegal_number https://en.wikipedia.org/wiki/Illegal_number

gsnedders 10y ago
> From CSS to AACS to HDCP[1]. I was hoping Firefox (and perhaps Chromium, but Google would probably not be so kind as to open source that part of the code) would have the DRM code built in so that we can spoof the whole thing with simple modifications. That fails to fulfil the requirements of pretty much any level of DRM, and hence such an implementation would be totally ignored and unused, and sites would continue to use Flash in preference to it. (I wish I could find the document Google published last year about the different levels of DRM the industry has been concluded need to exist for them to use; alas, I cannot!)
- lucb1e 10y ago
  > such an implementation would be totally ignored and unused Yeah I am a bit scared of that too, but then what would be the point of standardization in the first place?
  - gsnedders 10y ago
    Primarily to have a standard API to determine what DRM schemes the UA supports. A less important part of it is to avoid a different code-path for each different DRM scheme each with its own API.

micro_softy 10y ago

Avoiding DRM is easy. Avoid corporate-sponsored browsers. Writing programs that download files is not beyond the capabilities of average programmers. And internet users have ample access to open file formats and source code to read and write them. Who controls media formats? Who controls media players? "Browser"? What is that? A program to "browse" hypertext has evolved into something with far more functionality than is actually required for digesting media. As this complexity grows the notion of the "browser" will continue to be used to the greater advantage of corporations engaged in commerce, not users. Proprietary browsers, or ones that are too complex for ordinary programmers to compile from source, can be the equivalent of proprietary media formats and proprietary media players, in effect. The greatest opportunity to avoid DRM is in choice, not steering committees. Choice, as in, choice of what software to use. And that includes "browsers". Think outside the browser. Thank you.

contingencies 10y ago

Vote with your money. Don't buy Apple or Google devices, don't pay for Netflix or similar DRM streaming systems, don't buy Kindle books, don't buy Steam games. Buy unlocked media only, and don't forget to create some of your own.

givinguflac 10y ago
I wouldn't ever buy content I will own with DRM, but if you think you'll ever see streaming without DRM you're crazy. Personally I've done my fair share of pirating for various reasons, and I think streaming services are the ONLY reasonable use case for DRM. You aren't actually purchasing content.
- contingencies 10y ago
  Streaming without DRM comes pre-installed on TVs here in China, and there are many torrent-based solutions as well.
gok 10y ago
So basically, avoid all entertainment.
clarry 10y ago
> Don't buy Apple or Google devices Never did > don't pay for Netflix or similar DRM streaming systems Never did > don't buy Kindle books Never did > don't buy Steam games Never did > don't forget to create some of your own. Working on it. But shit like this is still happening all the time, despite "voting" throughout my life. I don't think such voting is effective.

pc2g4d 10y ago

I'm just not so sure the EME is so horrible. If companies want to deliver their content encrypted then they will do so.

oldmanjay 10y ago

The politics of desire always make for fascinating attempts at rationalization

Waterluvian 10y ago

Isn't this just an arms race that they can never win? Regardless of source, encryption, format, etc. If a frame of a movie eventually makes it to my video card's buffer, I can get at it, right? There is no end-to-end encryption from source into my brain. I can only see this just being a colossal inconvenience for users, developers, and many many innocent applications.

mordocai 10y ago
The end game would be decrypting it in the display device (better have a movie conglomerate approved video card and display device so everything supports the drm!) + one of the many solutions lately that can cause recording devices to (voluntarily at the device level, not at the user level) turn off. Then of course you just use a non-broken recording device and record it but it'd be potentially very hard to get a purely digital signal out of a system like that (unless they mess it up, which they will). And in the end pirates will continue getting to it an alternative way or cracking the drm and as you say, users are the ones inconvenienced.

throw2016 10y ago

I think DRM is anti culture. Human history has been about sharing. We are a product of the whole. Cultural wealth has been passed down hundreds of years. Now the story tellers and singers do not want you to repeat their stuff, which put in perspective is not a very cultural thing to do. And the only reason they can do this is because interests can congregate and technology can be abused but it seems morally and ethically questionable. You are not stealing anything, you are watching or listening to a product of our culture. You do not take anything away from anyone. Its just a small period of 70 years before the internet when mass media and content creators could colloborate to 'manufacture trends', hits and disproportionate wealth. Before that artists went broke and risked everything just to get their stuff published and out to readers and viewers. Obviously this is not how it should be but the whole 'jetset star lifestyle' may not always be possible simply because you are an artist. The problem is now that kind of 'trend manufacturing' is much harder to pull off. But the entire industry from studios to artists have got throughly spoilt, got used to those disproportionate returns and are now throwing all their toys out of the pram. Artists create but the rest of the world is also busy creating stuff. Engineers, industrial designers, scientists, programmers, eveyone is creating stuff. Can anyone just be 'entitled' to extraordinary wealth just because they create. Maybe its their cost structures, business models and expectations that need to change. DRM is just a tantrum backed by money, its rent seeking of the worst kind and our democractic institutions and systems are so compromised by special interests they will continue to get their way.

grogenaut 10y ago

EDIT: I'm not trying to bag on them, I just think they need to work on their messaging if they want to be effective: That website seems about as in touch with people not of the same mindset as the back pages of norml's website (once you got past the parts written by a pr person). It's got a rotating banner to "cancel netflix" which links to a 2013 post about how netflix will make you use only certain browsers. Makes the site either seem disused... or "tinfoil" as I think most consumers love netflix. (note I only used norml as an example because their site used to (and may still be) well articulated argument on the front which quickly devolves into what many people would see as weakly argued reasons for letting me get high. it's why, in any movement, you put your articulate people out front even if they're not the real driver).

ubersoldat2k7 10y ago

There seems to be lots of confusion of what EME is because people bring up images, text and games. First of all, EME is targeted to video and, to less extent, music streaming. Streaming video content to web browsers is, currently, a mess. There are many DRM schemes and each does its own crazy shit to try and make it work on everyone's browser. It's also expensive. So expensive that only big companies will target big platforms. Also, EME doesn't affect only web browsers, it also affects SmartTVs which are limited to a few DRM products. What EME and CENC try to achieve is to add simplicity to this process and for open source products to be able to compete with closed source ones. Even small DRM products are moving on this direction because it's impossible for them to target all platforms. On this regard, even an open source DRM scheme could be achieved and compete. DRM, EME and CENC will happen, and this only hurts open source products like Linux and Firefox. But it will happen.