18 ms·

Tim Berners-Lee Officially Supports DRM in HTML

93 points by joseluisq 9y ago

jamespo 9y ago
I can't find where in the article people are being forced to use this?
- Ygg2 9y ago
  When content providers, a la YouTube switch to it.
  - karmadog 9y ago
    YouTube probably won't force this, but even if they do, nobody forces you to use YouTube.
    - Ygg2 9y ago
      YouTube doesn't need to want to use this, the content providers will be breathing in its neck about NotDoingEnoughToStopPirates, and they'll comply out of wish to avoid frivolous lawsuits. Riiight, I'll just move to next high speed, high capacity video platform, that will magically grow in the meantime.
verytrivial 9y ago
Choice summary quote: > The problem here seemed to be that Netflix and the MPAA realized that they had enough power to push this through without needing to protect security researchers, and just decided "we can do it, so fuck it, let's do it." And Tim Berners-Lee -- who had the ability to block it -- caved in and let it happen. The whole thing is a travesty.
- cdubzzz 9y ago
  Also, this line of thinking really stood out to me - > [...] this argument [that DRM is a necessary evil] rests on the assumption that the web needs those content producers more than those content producers need the web -- and I'm not convinced that's an accurate portrayal of reality. It is fair to note that, especially with the rise of smart devices from phones to tablets to TVs, you could envision a world in which the big content producers "abandoned" the web and only put their content in proprietary DRM'd apps. And maybe that does happen. But my response to that is... so what? I have to agree with the author here - so what? I don't think such "proprietary DRM'd apps" would have any trouble taking off for people seeking content from big providers, so why does W3C feel it needs to bend so far to the will of Netflix and the like?
  - thegayngler 9y ago
    I don't know the scenario you provided is what I had hoped would happen not that they would html would have DRM support.
- Touche 9y ago
  This is what I don't get about the W3C and it's significance. Tim Berners-Lee (who is a personal hero of mine) could have blocked it, sure, but that means absolutely nothing. Like, nothing whatsoever. Since Tim Berners-Lee doesn't author a popular web browser. The only opinions that matter are those of Google, Apple, Microsoft, and Mozilla. And not all at the same significance. But that's it, that's the entire list. So I don't understand why W3C is even involved any more, why it even exists? It has no power, so... what's the point?
  - jancsika 9y ago
    Tim Berners-Lee's position looks worse from that perspective. If he truly had no power to change or even influence the outcome, why would he take a position of compromise on his core values? For a comparison, take Richard Stallman's stance on not owning/carrying a cellphone. His position clearly does not influence telco policy, nor gov't policy on surveillance law. He has even stated publicly that it is a symbolic action and that he depends on the ability of others around him to make urgent calls if necessary. Yet he still takes the symbolic action. Why? Because standing up for one's principles is important, even in the face of a large inconvenience (or even dependence in this case on others). Berners-Lee would suffer essentially zero inconvenience from taking a principled stance in the face of much larger corporate players who in reality determine W3C policy. His only hit would be to his ego, since it would reveal that his stance is largely symbolic rather than being a real player in the W3C. I can certainly understand his stance given the prominence of such compromises in the tech industry. But I certainly do not agree with it, and I find it likely that history will not honor it as a principled stance.
TrickyRick 9y ago
Can't browser manufacturers simply refuse to implement this standard? After all if Google doesn't implement it there will be some 70% of users not able to use Netflix (Or whatever other service requires this) and that might be a good enough incentive for Netflix to skip out on DRM.
- realusername 9y ago
  DRM is only there because of Chrome implementing it, Firefox resisted but had to give up due to market share.
- leppr 9y ago
  Yea but what's the incentive for Google ? They are a player in this space as well, and if anything they seem to want to scale up (Youtube Red, etc). (And suddenly, people remember how monopolies hurt consumers and regret giving Chrome so much market-share. Or not.)
  - dakom 9y ago
    Widevine
  - xyzxyz998 9y ago
    I would ask people to get off Chrome & GitHub. Chrome for future of browsing and github for future of development. There are wonderful (I'd dare and say better) alternatives very easily available. "As long as monopoly doesn't hurt me, why should I care."
  - amelius 9y ago
    This is somewhat ironic, since Youtube became big because of content right infringements.
    - dasil003 9y ago
      Cross the bridge and then burn it is a proven strategy, I wouldn't exactly consider it ironic.
IanCal 9y ago
Honest question: What is different about this compared to all the previous things we've had that used plugins?
- pix64 9y ago
  The DRM plugin is for decryption only and runs in a sandbox (in Firefox anyways). Flash has a much larger attack surface. Performance of flash is usually much poorer when compared to the browser's video player.
  - hrrsn 9y ago
    Not trolling, just genuinely curious: what about this is so awful then? This sounds like a step in the right direction?
    - jazoom 9y ago
      I also don't understand the big deal. I'd be happy for someone to point out the obvious thing I'm missing. I believe content creators/owners should be able to do whatever they want with what they create/own, just like I can do whatever I want with what I create/own.
      - Flimm 9y ago
        DRM makes it hard for me to make backup copies of media that I've bought and own, so you can see how DRM goes against your stated belief. That's just one for starters. The article itself goes into a few more reasons.
        jazoom 9y ago
        But that doesn't go against my stated belief. If someone wants to offer you a time-limited or location-limited video they can do that. You don't have to pay for it. And I say this as an Australian who doesn't pay for Netflix because of stupid regional restrictions. Vote with your wallet and let people do as they please.
askvictor 9y ago
I agree that DRM is a bad thing, but in this instance, what is the alternative to implementing in the browser? Media companies will each have their own DRM plugins, which won't work on all browsers and platforms. Which is worse?
- jug5 9y ago
  DRM in HTML is worse.
- kuschku 9y ago
  DRM in the browser is worse. Because it makes this too easy. Now Facebook and Twitter wre considering DRM for their video content, and YouTube is already implementing it. In a few years you won't be able to download a single video you see on the web. Great.
  - trumbitta2 9y ago
    And despite the downvotes, this is a huge problem because videos are not only movies and tv series: videos are also interviews, live reporting, crimes, calling out politicians or worse. If you can't download those, you have one card less to play when they decide to put them down from the Internet.
- Touche 9y ago
  Being in the spec is worse, because now it is the browser's responsibility. This is what EME defenders don't seem to understand, it's all about offloading the responsibility off of media companies and onto browser vendors. Let me repeat that, EME is a redistribution of software maintenance (bugs, etc.) off of the media companies and onto browser vendors.
  - tehbeard 9y ago
    Past experience with buggy software has shown me media companies are way worse at this than Microsoft/Google/Mozilla whose job is to ship working code.
SquareWheel 9y ago
Well that's an awfully uncharitable title. Isn't it possible he simply thinks EME is a better alternative than Flash/Silverlight? Because I sure do.
- le-mark 9y ago
  Fortunately the article is more even handed than the title and cites two broad issues with this: > First, the question of whether or not EME even needs to be in HTML at all. Many -- even those who dislike DRM -- have argued that it was kind of necessary. The underlying argument here is that certain content producers would effectively abandon the web without EME being in HTML5. > The second issue is much more problematic. A bunch of W3C members had made a clear proposal that if EME is included, there should be a covenant that W3C members will not sue security researchers under Section 1201 of the DMCA should they crack any DRM. There is no reason not to support this. Security researchers should be encouraged to be searching for vulnerabilities in DRM and encryption in order to better protect us all.
  - edraferi 9y ago
    Adding legal agreements into a technical standard is tricky. Security researchers absolutely need protection, but it should be addressed at via legislation. There needs to be a clear way to distinguish security research from malicious hacking that applies across technologies.
    - syshum 9y ago
      Fat chance that happening, if anything we will see increased restriction on who is allowed and not allowed to "research" security limited to only government approved contractors that file for permission to do with the FBI
- kuschku 9y ago
  It's not a better alternative, because it makes DRM too easily accessible. Many companies that would never have used Flash for DRM are now using EME or considering it. Including YouTube, Twitter, Facebook, etc. In a few years every video on the web will use DRM, and you won't even be able to download YouTube videos.
dakom 9y ago
I don't get the gripe. EME is used solely for wrangling media bits and it doesn't insist on any specific CDM. It's up to the browser manufacturers to decide if they want to include any closed-source implementations. The fact that commercial browser manufacturers include their own closed-source implementation makes perfect sense (IE = playready, Safari = fairplay, Chrome = widevine). If ARRI decides to create a web browser, would you expect them not to allow their end users to natively play ARRI raw files if they could provide it, simply because other browsers can't include that closed-source capability? Seems to me like an arbitrary restriction. If I want to use open-source-only browser, and lose out on some of the proprietary commercial stuff I get elsewhere, that's a respectable choice, but it shouldn't be the only one.
- Touche 9y ago
  It's not the only choice. This is not about what browsers implement, this is about what open-standards spec.
  - dakom 9y ago
    Sure, but EME with an open-source clearkeys-only CDM is essentially equivalent to a vanilla js aes lib, no?
Phemist 9y ago
Considering Firefox is open-source, is patching in a backdoor to the EME implementation a feasible way of handling the DRM situation? I don't see many reasons why I would not want to be running client-side intentionally backdoored EME?
- kuschku 9y ago
  Firefox includes a proprietary binary for EME.
briantakita 9y ago
This has major political ramifications re: fair use. Given how many media outlets are known to be deceptive & to push agendas, it's important to be able to save the video to keep these organizations accountable... https://w2.eff.org/IP/DRM/fair_use_and_drm.html https://w2.eff.org/IP/DRM/fair_use_and_drm.html
Santosh83 9y ago
Don't blame Tim for what we ALL have done to the Internet since three decades. This was the inevitable result of commercialisation. Tim can't stop it, no matter how much respect/influence he might have. DRM (as an abstract idea) won't go until we stop having to earn money to survive, and I don't see THAT happening soon. The Internet has just become the latest arena where the age-old battle is playing out.
- dasil003 9y ago
  This. People don't understand the forces at work here. They think we can get a coalition of free software advocates to prevent the march of DRM, but they fail to realize that content rights-holders have market clout. Consumers will jump through whatever stupid hoops they put up. Meanwhile, free software advocates have no market clout, if they succeed in killing EME in a browser, then the general consumer perception will be that that browser is broken and will lose marketshare. This situation sucks, and I fought against it professionally for almost a decade, but at the end of the day if there's a market need for something, tech will be built for it in a completely amoral fashion.
merricksb 9y ago
Heavily discussed 5 days ago, about the same time this article was published: https://news.ycombinator.com/item?id=14720591 https://news.ycombinator.com/item?id=14720591
mnarayan01 9y ago
EME removes much of the cost associated with adding DRM to content in exchange for increased portability of content that is DRM'd. This doesn't seem like a good trade-off to me. Yes it's only for "media", but once it's essentially free to add DRM, I foresee a whole bunch of current content becoming "media" in ways that I'm going to find unfortunate even totally disregarding the DRM aspects. That said, I neither consume much content that's currently DRM'd nor do I have any technical difficulty accessing such content, so other's might want different trade-offs.
keithb- 9y ago
I definitely do not understand what's going on here. As noted in the appeal posted by Doctorow [1], DMCA prohibits bypassing DRM so this W3C "approval" seems completely unnecessary. If it's oversight that you want, then a W3C standard isn't the way. A W3C standard is just a description of system behavior; it doesn't carry with it any penalties for deviation. If it did, I would have sued all the browser devs who delayed support HTML5 elements citing compensatory damages: my livelihood was affected! At the same time, the appeal seems misaligned because (again) the specification may be superior in accessibility, privacy, etc. but the implementation can be total crap. What option do you have? Open a ticket for Chrome or Firefox? Stop watching Fox News because their plugin is buggy and slow? This whole thing seems like a polite disagreement among intellectuals. The EFF expected more from Berners-Lee but it turns out that he chose to act differently. [1] https://www.eff.org/deeplinks/2017/07/notice-w3c-effs-appeal-directors-decision-eme https://www.eff.org/deeplinks/2017/07/notice-w3c-effs-appeal...

93 points by joseluisq 9y ago

jamespo 9y ago

I can't find where in the article people are being forced to use this?

Ygg2 9y ago
When content providers, a la YouTube switch to it.
- karmadog 9y ago
  YouTube probably won't force this, but even if they do, nobody forces you to use YouTube.
  - Ygg2 9y ago
    YouTube doesn't need to want to use this, the content providers will be breathing in its neck about NotDoingEnoughToStopPirates, and they'll comply out of wish to avoid frivolous lawsuits. Riiight, I'll just move to next high speed, high capacity video platform, that will magically grow in the meantime.

verytrivial 9y ago

Choice summary quote: > The problem here seemed to be that Netflix and the MPAA realized that they had enough power to push this through without needing to protect security researchers, and just decided "we can do it, so fuck it, let's do it." And Tim Berners-Lee -- who had the ability to block it -- caved in and let it happen. The whole thing is a travesty.

cdubzzz 9y ago
Also, this line of thinking really stood out to me - > [...] this argument [that DRM is a necessary evil] rests on the assumption that the web needs those content producers more than those content producers need the web -- and I'm not convinced that's an accurate portrayal of reality. It is fair to note that, especially with the rise of smart devices from phones to tablets to TVs, you could envision a world in which the big content producers "abandoned" the web and only put their content in proprietary DRM'd apps. And maybe that does happen. But my response to that is... so what? I have to agree with the author here - so what? I don't think such "proprietary DRM'd apps" would have any trouble taking off for people seeking content from big providers, so why does W3C feel it needs to bend so far to the will of Netflix and the like?
- thegayngler 9y ago
  I don't know the scenario you provided is what I had hoped would happen not that they would html would have DRM support.
Touche 9y ago
This is what I don't get about the W3C and it's significance. Tim Berners-Lee (who is a personal hero of mine) could have blocked it, sure, but that means absolutely nothing. Like, nothing whatsoever. Since Tim Berners-Lee doesn't author a popular web browser. The only opinions that matter are those of Google, Apple, Microsoft, and Mozilla. And not all at the same significance. But that's it, that's the entire list. So I don't understand why W3C is even involved any more, why it even exists? It has no power, so... what's the point?
- jancsika 9y ago
  Tim Berners-Lee's position looks worse from that perspective. If he truly had no power to change or even influence the outcome, why would he take a position of compromise on his core values? For a comparison, take Richard Stallman's stance on not owning/carrying a cellphone. His position clearly does not influence telco policy, nor gov't policy on surveillance law. He has even stated publicly that it is a symbolic action and that he depends on the ability of others around him to make urgent calls if necessary. Yet he still takes the symbolic action. Why? Because standing up for one's principles is important, even in the face of a large inconvenience (or even dependence in this case on others). Berners-Lee would suffer essentially zero inconvenience from taking a principled stance in the face of much larger corporate players who in reality determine W3C policy. His only hit would be to his ego, since it would reveal that his stance is largely symbolic rather than being a real player in the W3C. I can certainly understand his stance given the prominence of such compromises in the tech industry. But I certainly do not agree with it, and I find it likely that history will not honor it as a principled stance.

TrickyRick 9y ago

Can't browser manufacturers simply refuse to implement this standard? After all if Google doesn't implement it there will be some 70% of users not able to use Netflix (Or whatever other service requires this) and that might be a good enough incentive for Netflix to skip out on DRM.

realusername 9y ago
DRM is only there because of Chrome implementing it, Firefox resisted but had to give up due to market share.
leppr 9y ago
Yea but what's the incentive for Google ? They are a player in this space as well, and if anything they seem to want to scale up (Youtube Red, etc). (And suddenly, people remember how monopolies hurt consumers and regret giving Chrome so much market-share. Or not.)
- dakom 9y ago
  Widevine
- xyzxyz998 9y ago
  I would ask people to get off Chrome & GitHub. Chrome for future of browsing and github for future of development. There are wonderful (I'd dare and say better) alternatives very easily available. "As long as monopoly doesn't hurt me, why should I care."
- amelius 9y ago
  This is somewhat ironic, since Youtube became big because of content right infringements.
  - dasil003 9y ago
    Cross the bridge and then burn it is a proven strategy, I wouldn't exactly consider it ironic.

IanCal 9y ago

Honest question: What is different about this compared to all the previous things we've had that used plugins?

pix64 9y ago
The DRM plugin is for decryption only and runs in a sandbox (in Firefox anyways). Flash has a much larger attack surface. Performance of flash is usually much poorer when compared to the browser's video player.
- hrrsn 9y ago
  Not trolling, just genuinely curious: what about this is so awful then? This sounds like a step in the right direction?
  - jazoom 9y ago
    I also don't understand the big deal. I'd be happy for someone to point out the obvious thing I'm missing. I believe content creators/owners should be able to do whatever they want with what they create/own, just like I can do whatever I want with what I create/own.
    - Flimm 9y ago
      DRM makes it hard for me to make backup copies of media that I've bought and own, so you can see how DRM goes against your stated belief. That's just one for starters. The article itself goes into a few more reasons.
      - jazoom 9y ago
        But that doesn't go against my stated belief. If someone wants to offer you a time-limited or location-limited video they can do that. You don't have to pay for it. And I say this as an Australian who doesn't pay for Netflix because of stupid regional restrictions. Vote with your wallet and let people do as they please.

askvictor 9y ago

I agree that DRM is a bad thing, but in this instance, what is the alternative to implementing in the browser? Media companies will each have their own DRM plugins, which won't work on all browsers and platforms. Which is worse?

jug5 9y ago
DRM in HTML is worse.
kuschku 9y ago
DRM in the browser is worse. Because it makes this too easy. Now Facebook and Twitter wre considering DRM for their video content, and YouTube is already implementing it. In a few years you won't be able to download a single video you see on the web. Great.
- trumbitta2 9y ago
  And despite the downvotes, this is a huge problem because videos are not only movies and tv series: videos are also interviews, live reporting, crimes, calling out politicians or worse. If you can't download those, you have one card less to play when they decide to put them down from the Internet.
Touche 9y ago
Being in the spec is worse, because now it is the browser's responsibility. This is what EME defenders don't seem to understand, it's all about offloading the responsibility off of media companies and onto browser vendors. Let me repeat that, EME is a redistribution of software maintenance (bugs, etc.) off of the media companies and onto browser vendors.
- tehbeard 9y ago
  Past experience with buggy software has shown me media companies are way worse at this than Microsoft/Google/Mozilla whose job is to ship working code.

SquareWheel 9y ago

Well that's an awfully uncharitable title. Isn't it possible he simply thinks EME is a better alternative than Flash/Silverlight? Because I sure do.

le-mark 9y ago
Fortunately the article is more even handed than the title and cites two broad issues with this: > First, the question of whether or not EME even needs to be in HTML at all. Many -- even those who dislike DRM -- have argued that it was kind of necessary. The underlying argument here is that certain content producers would effectively abandon the web without EME being in HTML5. > The second issue is much more problematic. A bunch of W3C members had made a clear proposal that if EME is included, there should be a covenant that W3C members will not sue security researchers under Section 1201 of the DMCA should they crack any DRM. There is no reason not to support this. Security researchers should be encouraged to be searching for vulnerabilities in DRM and encryption in order to better protect us all.
- edraferi 9y ago
  Adding legal agreements into a technical standard is tricky. Security researchers absolutely need protection, but it should be addressed at via legislation. There needs to be a clear way to distinguish security research from malicious hacking that applies across technologies.
  - syshum 9y ago
    Fat chance that happening, if anything we will see increased restriction on who is allowed and not allowed to "research" security limited to only government approved contractors that file for permission to do with the FBI
kuschku 9y ago
It's not a better alternative, because it makes DRM too easily accessible. Many companies that would never have used Flash for DRM are now using EME or considering it. Including YouTube, Twitter, Facebook, etc. In a few years every video on the web will use DRM, and you won't even be able to download YouTube videos.

dakom 9y ago

I don't get the gripe. EME is used solely for wrangling media bits and it doesn't insist on any specific CDM. It's up to the browser manufacturers to decide if they want to include any closed-source implementations. The fact that commercial browser manufacturers include their own closed-source implementation makes perfect sense (IE = playready, Safari = fairplay, Chrome = widevine). If ARRI decides to create a web browser, would you expect them not to allow their end users to natively play ARRI raw files if they could provide it, simply because other browsers can't include that closed-source capability? Seems to me like an arbitrary restriction. If I want to use open-source-only browser, and lose out on some of the proprietary commercial stuff I get elsewhere, that's a respectable choice, but it shouldn't be the only one.

Touche 9y ago
It's not the only choice. This is not about what browsers implement, this is about what open-standards spec.
- dakom 9y ago
  Sure, but EME with an open-source clearkeys-only CDM is essentially equivalent to a vanilla js aes lib, no?

Phemist 9y ago

Considering Firefox is open-source, is patching in a backdoor to the EME implementation a feasible way of handling the DRM situation? I don't see many reasons why I would not want to be running client-side intentionally backdoored EME?

kuschku 9y ago
Firefox includes a proprietary binary for EME.

briantakita 9y ago

This has major political ramifications re: fair use. Given how many media outlets are known to be deceptive & to push agendas, it's important to be able to save the video to keep these organizations accountable... https://w2.eff.org/IP/DRM/fair_use_and_drm.html https://w2.eff.org/IP/DRM/fair_use_and_drm.html

Santosh83 9y ago

Don't blame Tim for what we ALL have done to the Internet since three decades. This was the inevitable result of commercialisation. Tim can't stop it, no matter how much respect/influence he might have. DRM (as an abstract idea) won't go until we stop having to earn money to survive, and I don't see THAT happening soon. The Internet has just become the latest arena where the age-old battle is playing out.

dasil003 9y ago
This. People don't understand the forces at work here. They think we can get a coalition of free software advocates to prevent the march of DRM, but they fail to realize that content rights-holders have market clout. Consumers will jump through whatever stupid hoops they put up. Meanwhile, free software advocates have no market clout, if they succeed in killing EME in a browser, then the general consumer perception will be that that browser is broken and will lose marketshare. This situation sucks, and I fought against it professionally for almost a decade, but at the end of the day if there's a market need for something, tech will be built for it in a completely amoral fashion.

merricksb 9y ago

Heavily discussed 5 days ago, about the same time this article was published: https://news.ycombinator.com/item?id=14720591 https://news.ycombinator.com/item?id=14720591

mnarayan01 9y ago

EME removes much of the cost associated with adding DRM to content in exchange for increased portability of content that is DRM'd. This doesn't seem like a good trade-off to me. Yes it's only for "media", but once it's essentially free to add DRM, I foresee a whole bunch of current content becoming "media" in ways that I'm going to find unfortunate even totally disregarding the DRM aspects. That said, I neither consume much content that's currently DRM'd nor do I have any technical difficulty accessing such content, so other's might want different trade-offs.

keithb- 9y ago

I definitely do not understand what's going on here. As noted in the appeal posted by Doctorow [1], DMCA prohibits bypassing DRM so this W3C "approval" seems completely unnecessary. If it's oversight that you want, then a W3C standard isn't the way. A W3C standard is just a description of system behavior; it doesn't carry with it any penalties for deviation. If it did, I would have sued all the browser devs who delayed support HTML5 elements citing compensatory damages: my livelihood was affected! At the same time, the appeal seems misaligned because (again) the specification may be superior in accessibility, privacy, etc. but the implementation can be total crap. What option do you have? Open a ticket for Chrome or Firefox? Stop watching Fox News because their plugin is buggy and slow? This whole thing seems like a polite disagreement among intellectuals. The EFF expected more from Berners-Lee but it turns out that he chose to act differently. [1] https://www.eff.org/deeplinks/2017/07/notice-w3c-effs-appeal-directors-decision-eme https://www.eff.org/deeplinks/2017/07/notice-w3c-effs-appeal...