5 ms·

Meaning anyone can implement the technology that can show a web page. You can't show Netflix's web page, unless they preapprove of your DRM.

by Touche 10y ago

tptacek 10y ago
And that's different from a web page that won't allow you to access it without a password, how? In both cases, a business decision by a third party limits what you're able to access. I understand that you don't want to run code Netflix approves of and that you're not permitted to read in its original source form. And that's fine, a good reason not to subscribe to Netflix. But how is that any more an offense to "the open web" than a subscription-only website?
- Touche 10y ago
  > And that's different from a web page that won't allow you to access it without a password, how? It works the same regardless of what browser or OS you are using.
  - deleted 10y ago
    [deleted]
  - tptacek 10y ago
    The point of EME is to minimize the amount of code that differs between platforms, by standardizing everything but (in essence) the authenticated key derivation step.
    - BuuQu9hu 10y ago
      This is false. EME describes only the interface between the Javascript environment and the CDM. It says nothing about the CDM's interface with the browser code, which is the heart of the issue.
      - tptacek 10y ago
        You're rebutting an argument I didn't make. The CDM is closed-source, but it was closed-source in the pre-EME world too. My argument is that EME opens up DRM stacks; it's that it opens up more of the DRM stack than was open before it.
        BuuQu9hu 10y ago
        > by standardizing everything but (in essence) the authenticated key derivation step. Your argument is that EME covers most of the code responsible implementing DRM. This is false. EME is a small part. The large majority of the implementation is not standardized. For example, there is no equivalent of NPAPI in the post-EME world; the CDM/browser interface is browser-specific.
        tptacek 10y ago
        No, that's not my argument, as you can see from my comment above. What you've done here is twist my argument around to introduce claims I didn't make that you find easy to rebut.
        BuuQu9hu 10y ago
        > by standardizing everything but (in essence) the authenticated key derivation step Is there another interpretation of 'everything' in this context? You're making EME far more comprehensive than it is. CDMs do way more than derive a key, so your statement is false on its face.
        tptacek 10y ago
        What is it you're saying CDMs do? Maybe we're just talking past each other.
    - Touche 10y ago
      The point of EME is to make it impossible for a browser to show a web page without having financial deals with the websites (or a 3rd party representing the websites). That is what people oppose. The fact that you do not directly address this point and try to equivocate it to <input type=password> makes me question your good faith here.
- deleted 10y ago
  [deleted]
- BuuQu9hu 10y ago
  What you're missing is that passwords don't require blobs. The ContentDecryptionModules used for DRM on the Web are blobs. For a browser to run a blob, there needs to be an interface between the browser and the blob. Flash and Silverlight blobs used a standard interface: NPAPI. Any browser implementing NPAPI could run the blobs (assuming the blob was compatible with the host OS). CDMs have no such standard browser/blob interface (note that EME relates only to the Javascript environment not the actual browser code). In fact, the only browsers able to run these blobs are the ones that the CDM provider 'trusts' and is willing to provide proprietary information to in order for browser developers to get their blob working. Your independent Firefox fork will almost certainly never be able to support any major CDM; the CDM provider doesn't trust, nor care about your browser. Therefore, CDM providers arbitrarily _select_ which browsers can have access to their Web content. This is unprecedented. Content on the Web, in whatever form, has always been accessible by _any_ browser; it was merely a matter of that browser implementing the necessary standards. This is the idea of the open Web. CDMs are literally the opposite idea.
  - tptacek 10y ago
    I don't think I'm missing it, so much as I'm not understanding what the material difference is between your unwillingness to run a blob on your machine versus your unwillingness to do any of the other things a business might require before issuing you a password. You are free not to run those blobs, and not to use Netflix's services. Where you lose me is the militant demand that Netflix not offer services to those willing to run the blob.
    - BuuQu9hu 10y ago
      You need to address this: > This is the idea of the open Web. CDMs are literally the opposite idea. Yes, both a CDM and passworded accounts limit access to content. The difference is that CDM providers are only letting certain Web browsers view the content. Passworded accounts have no such limitation. The open Web is dependent on any conceivable browser being interoperable with ALL Web content. Any barriers to interoperability are only technical. Third-parties, like a CDM provider, cannot setup arbitrary barriers. Otherwise, it is no longer "open". THIS is the definition of 'open Web'; it has nothing to do with authorization as in subscription only websites.

Meaning anyone can implement the technology that can show a web page. You can't show Netflix's web page, unless they preapprove of your DRM.

by Touche 10y ago

Meaning anyone can implement the technology that can show a web page. You can't show Netflix's web page, unless they preapprove of your DRM.

tptacek 10y ago

And that's different from a web page that won't allow you to access it without a password, how? In both cases, a business decision by a third party limits what you're able to access. I understand that you don't want to run code Netflix approves of and that you're not permitted to read in its original source form. And that's fine, a good reason not to subscribe to Netflix. But how is that any more an offense to "the open web" than a subscription-only website?

Touche 10y ago
> And that's different from a web page that won't allow you to access it without a password, how? It works the same regardless of what browser or OS you are using.
- deleted 10y ago
  [deleted]
- tptacek 10y ago
  The point of EME is to minimize the amount of code that differs between platforms, by standardizing everything but (in essence) the authenticated key derivation step.
  - BuuQu9hu 10y ago
    This is false. EME describes only the interface between the Javascript environment and the CDM. It says nothing about the CDM's interface with the browser code, which is the heart of the issue.
    - tptacek 10y ago
      You're rebutting an argument I didn't make. The CDM is closed-source, but it was closed-source in the pre-EME world too. My argument is that EME opens up DRM stacks; it's that it opens up more of the DRM stack than was open before it.
      - BuuQu9hu 10y ago
        > by standardizing everything but (in essence) the authenticated key derivation step. Your argument is that EME covers most of the code responsible implementing DRM. This is false. EME is a small part. The large majority of the implementation is not standardized. For example, there is no equivalent of NPAPI in the post-EME world; the CDM/browser interface is browser-specific.
        tptacek 10y ago
        No, that's not my argument, as you can see from my comment above. What you've done here is twist my argument around to introduce claims I didn't make that you find easy to rebut.
        BuuQu9hu 10y ago
        > by standardizing everything but (in essence) the authenticated key derivation step Is there another interpretation of 'everything' in this context? You're making EME far more comprehensive than it is. CDMs do way more than derive a key, so your statement is false on its face.
        tptacek 10y ago
        What is it you're saying CDMs do? Maybe we're just talking past each other.
  - Touche 10y ago
    The point of EME is to make it impossible for a browser to show a web page without having financial deals with the websites (or a 3rd party representing the websites). That is what people oppose. The fact that you do not directly address this point and try to equivocate it to <input type=password> makes me question your good faith here.
deleted 10y ago
[deleted]
BuuQu9hu 10y ago
What you're missing is that passwords don't require blobs. The ContentDecryptionModules used for DRM on the Web are blobs. For a browser to run a blob, there needs to be an interface between the browser and the blob. Flash and Silverlight blobs used a standard interface: NPAPI. Any browser implementing NPAPI could run the blobs (assuming the blob was compatible with the host OS). CDMs have no such standard browser/blob interface (note that EME relates only to the Javascript environment not the actual browser code). In fact, the only browsers able to run these blobs are the ones that the CDM provider 'trusts' and is willing to provide proprietary information to in order for browser developers to get their blob working. Your independent Firefox fork will almost certainly never be able to support any major CDM; the CDM provider doesn't trust, nor care about your browser. Therefore, CDM providers arbitrarily _select_ which browsers can have access to their Web content. This is unprecedented. Content on the Web, in whatever form, has always been accessible by _any_ browser; it was merely a matter of that browser implementing the necessary standards. This is the idea of the open Web. CDMs are literally the opposite idea.
- tptacek 10y ago
  I don't think I'm missing it, so much as I'm not understanding what the material difference is between your unwillingness to run a blob on your machine versus your unwillingness to do any of the other things a business might require before issuing you a password. You are free not to run those blobs, and not to use Netflix's services. Where you lose me is the militant demand that Netflix not offer services to those willing to run the blob.
  - BuuQu9hu 10y ago
    You need to address this: > This is the idea of the open Web. CDMs are literally the opposite idea. Yes, both a CDM and passworded accounts limit access to content. The difference is that CDM providers are only letting certain Web browsers view the content. Passworded accounts have no such limitation. The open Web is dependent on any conceivable browser being interoperable with ALL Web content. Any barriers to interoperability are only technical. Third-parties, like a CDM provider, cannot setup arbitrary barriers. Otherwise, it is no longer "open". THIS is the definition of 'open Web'; it has nothing to do with authorization as in subscription only websites.