6 ms·
What many people that are on the periphery of this discussion sometimes fail to realize is that DRM is already here and already employed by many companies. The
by soapdog 9y ago
What many people that are on the periphery of this discussion sometimes fail to realize is that DRM is already here and already employed by many companies. The current DRM solutions are basically roll-your-own and each company has their own custom stuff which may or may not be vulnerable to attacks and steal/fingerprint the user thus affecting their privacy. This is the current state of things.
The EME/DRM spec is a bit different in which we still have DRM and it still sucks, but this DRM is now running on a sandbox environment and is standardized which makes it much easier to audit and a lot safer to use in terms of privacy for the user.
Of course "no DRM" is a better solution than "any DRM", but that is a pointless debate because content distributors are already onboard with DRM and there is no turning them back. The W3C spec is a compromise, a solution that enables those wanting to use DRM to be able to do so while we maintain some method of sandbox, privacy and safety. Running a module in EME/DRM is probably much safer than doing the same thing now with custom browser plugins.
As for the discussion of "browser X should not implement it, traitors!!!! Hate you forever!!! Will switch to $MORE_PROPRIETARY_ALTERNATIVE" is also a shortsighted argument in my opinion. If a browser doesn't implement EME/DRM spec, they shut their users out from being able to use many websites that employ DRM and what will happen is that that browser will loose users. If every single browser said "no to DRM" except for a single one, you'd see everyone installing that browser just to be able to play Netflix.
No browser can afford to loose millions of users by not implementing the spec. Those users matters. In terms of browser vendor political weight in spec discussions, user count matters. The DRM battle is a lost one because the content producers/distributors already decided to use it.
Now, if you're against DRM, instead of complaining about W3C spec'ing it out and browser vendors implementing it. You should stop using DRM content. No one is stopping anyone from preferring non-DRM solutions. For example, I don't like light beer, the existence of light beer sounds wrong for me, so I don't drink it but I don't try to stop others from drinking said watery yellow-ish drink. It is the same thing with DRM, instead of focusing your actions on W3C and browser vendors, focus your effort in content producers/distributors, prefer other solutions, make them ponder if it is worth loosing you.
- syshum 9y ago>>but this DRM is now running on a sandbox environment I see this said many times, and it is highly over rated. while Technically speaking yes it calls for a "sandbox" but the need for "Computer Verification" means the CDM has to have full access to the entire system to verify the evil user is not attempting to capture the output. So the sandbox is not really protecting much unless the operating system itself has the CDM integrated as is the case for Windows. So on windows the CDM might be in a functional sandbox but on linux or any other non-proprietary system it is unlikely the sandbox will protect the user from a bad CDM, and given windows track record for security I would not put much faith in their sandbox either. On the security front I do not believe it has changed much, this idea that the CDM will be more secure seems to be more PR Marketing than actual fact. Further given the refusal of companies to sign onto a Non-Aggression Pledge to protect researchers from DMCA liability it is likely any security issues in the CDM's will go unreported for fear of legal repercussions. >>>Now, if you're against DRM, instead of complaining about W3C spec'ing it out and browser vendors implementing it. You should stop using DRM content. Why can a person not do both? Why does a person that has ethical problems with DRM, and view the actual existence of DRM is a threat to their personal liberty be silenced or told to STFU as you have here? Bad ideas, like DRM, should be continually criticized until they are dead. Vocal opposition as well as monetary boycotts are both valid and should be used to oppose bad ideas like DRM One of the reason people are opposing video DRM so strongly at the w3c level is we fear it will not stop with Video. Images, Ebooks, Fonts even the web pages themselves are all a target for DRM Supporters. There will come a time that the F12 tools will be useless because the entire page itself is being served via a locked down CDM style plugin. This is just the first phase of killing the Open Web in its entirety
- icebraining 9y agoRegarding the sandbox, that's not correct on all browsers: [I]n Firefox the sandbox prohibits the CDM from fingerprinting the user’s device. Instead, the CDM asks the sandbox to supply a per-device unique identifier. This sandbox-generated unique identifier allows the CDM to bind content to a single device as the content industry insists on, but it does so without revealing additional information about the user or the user’s device. In addition, we vary this unique identifier per site (each site is presented a different device identifier) to make it more difficult to track users across sites with this identifier. https://hacks.mozilla.org/2014/05/reconciling-mozillas-mission-and-w3c-eme/ https://hacks.mozilla.org/2014/05/reconciling-mozillas-missi...