5 ms·
You're not getting EME extensions from Apple, you're getting them from the third-party that developed the extensions. You can count on terrible security vulner
by davexunit 10y ago
You're not getting EME extensions from Apple, you're getting them from the third-party that developed the extensions. You can count on terrible security vulnerabilities being found in these.
Movies aren't important. Netflix isn't important. The open web, the ideology (or as you put it pejoratively, "purity") behind it, is important.
- maxerickson 10y agoSo when an EME is installed open videos don't play anymore or something?
- jasonmp85 10y agoYou don't need to Trojan-horse DRM into W3C standards to kill the web. Facebook Instant Articles, Google AMP, adtech, and general trends toward centralization are doing that just fine with no changes in standards whatsoever. The amount of heat this change has generated is disproportionate to its actual role as a threat to the open web
- tzs 10y agoWhat do you mean by "open web"? From the beginning or near the beginning it was possible and not uncommon to put things on the web with restricted access. The HTTP protocol itself supports a couple of login mechanisms which were intended to be used to restrict access to content, and these have been there since at least as early as 1996.
- Touche 10y agoMeaning anyone can implement the technology that can show a web page. You can't show Netflix's web page, unless they preapprove of your DRM.
- tptacek 10y agoAnd that's different from a web page that won't allow you to access it without a password, how? In both cases, a business decision by a third party limits what you're able to access. I understand that you don't want to run code Netflix approves of and that you're not permitted to read in its original source form. And that's fine, a good reason not to subscribe to Netflix. But how is that any more an offense to "the open web" than a subscription-only website?
- Touche 10y ago> And that's different from a web page that won't allow you to access it without a password, how? It works the same regardless of what browser or OS you are using.
- deleted 10y ago[deleted]
- tptacek 10y agoThe point of EME is to minimize the amount of code that differs between platforms, by standardizing everything but (in essence) the authenticated key derivation step.
- BuuQu9hu 10y agoThis is false. EME describes only the interface between the Javascript environment and the CDM. It says nothing about the CDM's interface with the browser code, which is the heart of the issue.
- tptacek 10y agoYou're rebutting an argument I didn't make. The CDM is closed-source, but it was closed-source in the pre-EME world too. My argument is that EME opens up DRM stacks; it's that it opens up more of the DRM stack than was open before it.
- BuuQu9hu 10y ago> by standardizing everything but (in essence) the authenticated key derivation step. Your argument is that EME covers most of the code responsible implementing DRM. This is false. EME is a small part. The large majority of the implementation is not standardized. For example, there is no equivalent of NPAPI in the post-EME world; the CDM/browser interface is browser-specific.
- asdfgadsfgasfdg 10y agoThe OP is using the phrase "open web" in the standard way.