19 ms·

The blame for this sits squarely on the w3c for their efforts in trying to replace flash by letting the content companies dictate standards for encrypted playba

The blame for this sits squarely on the w3c for their efforts in trying to replace flash by letting the content companies dictate standards for encrypted playback. If they had held fast, we could have forced the companies to do their key management in something like WebAssembly and avoided this gatekeeping mess.

gsnedders 8y ago
No, if the Director had overridden the majority of the membership, the browser vendors would've shipped something anyway, and the YouTubes and Netflixes of the world would be using it anyway.
- fixermark 8y ago
  Essentially. The money gated behind a closed DRM solution is so large that the w3c ran the risk of becoming an irrelevant standards body for this space if they didn't comply with what their members wanted to do. It's sub-optimal, but I don't think an optimal solution actually existed. A standards board divorced from reality is no better than no standard at all.
- Touche 8y ago
  > No, if the Director had overridden the majority of the membership, the browser vendors would've shipped something anyway That's fine. It's better that the burden for maintaining non-standard plugins be put on the sites and browsers that choose to do that, rather than be placed on everyone else.
  - geofft 8y ago
    How would that have improved the current situation? The videos that Metastream wants to play would still have been DRM'd and would still be playable in the mainstream browsers. What would the benefit have been? What burden is being placed on people now that wouldn't be placed on people in that scenario?
    - AnthonyMouse 8y ago
      Making the user experience of DRM worse is better because then fewer people will use it. If the platforms all made it so that you have to solder a new chip into your phone before you can play DRM content, there would be a lot less DRM. The argument that platforms have to do this for competitive reasons is doublethink. If the experience is worse and that will cause customers to flee, how is it that they would only flee from the platforms that don't have DRM but not the content providers that require it? Wouldn't that create a huge market opportunity for new DRM-free studios, who would then out-compete the traditional ones by being available on all platforms instead of only on Insecure Expensive Proprietary Slow Cableco Platform Nobody Likes?
      - gsnedders 8y ago
        Would it have made the user experience of DRM any worse than it currently is, though? The DRM module would still ship with Chrome and Edge (and likely Safari too, given Apple became involved pretty quickly), you'd still need multiple different streaming formats (in the form of different DRM formats) as you do today, and maybe you'd need slightly different JS codepath per-browser too (but that's not a big difference to today with the different DRM formats). It's very unclear to me that the W3C refusing to be involved from day one would've led to any outcome very more than subtly different than the one we ended at. At the point that the specification went to Recommendation, there were already multiple interoperable implementations, so objecting at that point was purely a matter of principle, it literally wouldn't have affected the outcome in any way.
        AnthonyMouse 8y ago
        If the W3C making the right decision would make them irrelevant then what has actually happened is that they're already irrelevant, and becoming a rubber stamp on bad ideas only serves to prove that and erode their credibility. Moreover, such organizations are made up of their members, and it's up to the members to do the right thing as well. Nobody had to volunteer to be the first to add this gunk to their browser. It can't be a competitive disadvantage if nobody else has it either, and it can't be a competitive advantage if everybody else has it, and those are the two options so why not choose the first?
  - skybrian 8y ago
    It's funny how people try to make "standard" mean something magical when it's not. An Internet standard is just a document written by a committee of people who intend to do what it says. They then publicize it and try to get people to go along with it. You can't keep people from getting together to write a document or from doing what the document says. You can just choose whether to participate. If W3C chose not to help write the DRM standard, the browser vendors could easily create a new organization and write a standard anyway (as happened with WHATWG). Browser vendors and website authors could then read that document just as easily as anything published on the W3C website, so there is no "burden" for them. There would be no difference to the end user. The only burden we're talking about is the inconvenience of setting up an organization to do the writing. It's a minor speedbump at best. The upshot is that there is no way to prevent browser vendors from standardizing anything they want. It only gets blocked if they disagree.
    - Touche 8y ago
      No one is implying that not infecting W3C with DRM is going to kill DRM. Of course anyone can agree to things in whatever organized way they want to. The reason to keep it out of W3C is because it violates their core mission: https://www.w3.org/Consortium/mission#principles https://www.w3.org/Consortium/mission#principles . Other organizations with a different mission are free to do as they wish, obviously.
- adl 8y ago
  Welcome to the 21st
ohithereyou 8y ago
The W3C exists partly to take the blame off of its members for the decisions that they agree to unanimously. Blame the W3C members for their decision to screw the user.
- gsnedders 8y ago
  The W3C membership nowhere near unanimously approved the advancement of the EME specification to Recommendation; that much has been said publicly by various people over the course of the past few years. The majority of the membership was in favour, definitely, but it wasn't unanimous. Some members I think it's predictable how they voted (MPAA may have voted in favour, EFF may have voted against); others less so.
derefr 8y ago
It was never gonna happen; as soon as Intel introduced SGX, any DRM-producing company that wasn’t taking advantage of it would be seen as failing their shareholders. Even if Flash had died on schedule without browsers offering a native browser-DOM DRMed-content API, DRMed-content producers would just have jumped to another tech the DRM vendors sold them. My guess is that, if browser vendors wouldn’t have played ball, the DRM vendors would have worked with one of the JRE vendors to optimize the Java applet runtime, and contributed to performance improvements on the browser side for all the open browsers, such that “Java applet” would no longer be a scary heavy-weight thing nobody wants their browser to launch. That would be (one of) the implicit threats hanging over browser vendors: if you don’t cooperate, we’ll take your control over innovation on the web away by refocusing it on an improved Java experience.
- AnthonyMouse 8y ago
  How is that "threat" a problem? That sounds like an Old Microsoft objection to cross-platform code, but the web is already cross-platform code, so that doesn't make any sense. And if the browser vendors really didn't like it for unknown reasons then they could have just stopped supporting Java in the browser, as has largely already happened for various other reasons. This is one of those "we all must hang together or we shall all hang separately" situations, and they apparently decided they'd prefer to hang separately.
wolfgke 8y ago
> The blame for this sits squarely on the w3c for their efforts in trying to replace flash by letting the content companies dictate standards for encrypted playback. The blame for this sits squarely on the users for their tolerance of malware (which DRM is) in the browsers that they use.
- monetus 8y ago
  Do you think most users even know what drm is, or that it's being run?
  - wolfgke 8y ago
    I tell it to my acquaintances all the time. Nearly all of them are not interested in this information.
    - suprfsat 8y ago
      They could be your friends if you'd stop.
    - monetus 8y ago
      I wonder how much of this is simply cognitive overload. I mean, climate change, crispr, ocean acidification, asteroids... I would guess that most people prioritize dopamine first and foremost. Software is arcane, so thinking about how it affects society probably seems irrelevant to them. Even if they do care, power dynamics make defeatism a logical and realistic mindset.
      - gowld 8y ago
        If you use Netflix as advertised, you don't need to know about DRM; it does its job without being noticeable. Netflix is a streaming service, not a movie store. There's no need for making backups. If you try to use Netflix outside the bounds of your agreement (like copying downloads to a different device), then the DRM becomes visible.
jcranmer 8y ago
Blame Google and Microsoft. They were the people who created the specification, and pushed for it, when Netflix came begging for a solution to their DRM conundrum. Even if the W3C hadn't approved it, that's two of the big four browser vendors who are committing to implementing it anyways, which is enough to guarantee a de facto standard anyways.
- tiraniddo 8y ago
  No, blame the movie studios, record labels etc. They're the one which require asinine DRM support for web browsers. Google/Microsoft/Apple/Adobe want to support media content, but to do so requires towing the line with the media companies otherwise they refuse to license the content (at least in HD+). Having worked with various DRM teams I know that they have to treat their code as if its the most secret code in the world, if they don't the media companies can swoop in and ban them and then no Netflix for your users. This is why Widevine code isn't open source (other than the glue EME code) and is almost certainly the reason for the refusal to work with a small open-source form of Chromium. If for example the project was used to "steal" content the media companies would be mad at Widevine, with lasting repercussions for all Chrome users. It's worth noting that typically all DRM teams work as if the hosting environment is an adversary. For example Widevine don't trust anything Chrome says as someone could recompile it and lie about the security. The only times this is relaxed is where the platform is deemed secure, such as CrOS or iOS.
  - Zak 8y ago
    The weird thing about this is I can find a high-quality torrent for anything on Netflix in under a minute.
    - sabujp 8y ago
      DRM are like locks on a house, just keeps honest people out
      - gloflo 8y ago
Arnt 8y ago
I don't suppose you remember, but they did their key management in native code plugins 10-15 years ago. Silverlight and Flash both had DRM capability, IIRC. I've worked with that and it was no joy at all. Without W3C DRM they would have kept those plugins alive instead of deprecating them. I see no reason why they'd have migrated to webasm, webasm wouldn't provide the know-thy-customer aspect the DRM people want.
DCKing 8y ago
> The blame for this sits squarely on the w3c for their efforts in trying to replace flash by letting the content companies dictate standards for encrypted playback. It really isn't. The W3C at the very least permits a solution whereby content companies liberally distribute binary blobs for every platform under the sun. Hell, it even permits an open source solution that e.g. speaks directly to the DRM hardware in graphics chips (don't know if that would be technically feasible, don't shoot me). It doesn't have to be this way. In this context it's really specifically Google being assholes about this. They can choose to not be assholes about this. The fact that the W3C allows them to be assholes about this doesn't change the fact that Google is choosing to be this way about it.
sigi45 8y ago
How would have that worked? If you do not sign every single file per user, there is no real way to get something secure if you do not controle the whole processing pipeline.
GuB-42 8y ago
The W3C isn't to blame. No one is to blame, really. We have DRM, we hate it but it's there, and it serves a purpose. If it is your intellectual property, you get to decide how it is used. And if you don't want to make copying too easy because you think that it will get you more money, that's your right. The goal of the W3C is not to make to make a political statement about the rightness or wrongness of DRM. They are here to create standards that respond to use cases. And unfortunately, copyrighted content diffusion is one use case, and content owners want DRM. And if you read the standard they came up with, it is not that bad. They managed to isolate the "evil DRM" part well enough without completely destroying its effectiveness. They also didn't require any proprietary component, though services can require them (that's what happened in the article). Using WebAssembly (which is essentially optimized JS) for DRM is a terrible idea IMHO. DRM, to be effective, usually requires access to protected system components. It means that to make an effective enough DRM to be accepted by content providers (which is the entire point of the standard), we would need to give WebAssembly way to much power.
- xg15 8y ago
  The problem is that pretty much the only way to satisfy those obligations is to turn the internet into a huge walled garden (as is currently happening). So we'll either have to accept the consequences of that, decide that some of the rightsholders' claims described above are not in the public interest or find some kind of middle ground.
- simias 8y ago
  You make good points but: >And if you don't want to make copying too easy because you think that it will get you more money, that's your right. They seem to think that but is there any truth to it? I do pirate some series/movies from time to time (mostly out of convenience) and you can get high quality rips of pretty much anything mere hours after it's available on streaming sites anyway. So what is this DRM supposed to achieve? Prevent the average non-technical user from saving the stream? I mean I'm sure they wouldn't even know where to start, there's no "Save As" button on Netflix for instance. Simple client-side limitations would do the trick for 99.9% of the population. On the other hand the few technically-savvy stream rippers seem to have no issue bypassing these protections. DRM works better for interactive content like games because it's not just about ripping the output. How many decades do we have to suffer through this broken scheme and this technical debt until the right owners realize that they're wasting their time and their resources to push a system that only serves to make it harder for legit clients to consume their contents? When iTunes got rid of DRM on music files I thought it would be the tipping point where right owners would realize that this scheme was ineffective and counter-productive, but apparently it's still an industry standard for some reason. Have legit users on unsupported systems stream low-res video while the pirates can watch it in 4k for free. Ridiculous.
deleted 8y ago
[deleted]
908087 8y ago
Tim Berners-Lee's Google-funded $1M Turing award sure smelled like a payoff to me. If it wasn't, the timing sure was convenient.

gsnedders 8y ago

No, if the Director had overridden the majority of the membership, the browser vendors would've shipped something anyway, and the YouTubes and Netflixes of the world would be using it anyway.

fixermark 8y ago
Essentially. The money gated behind a closed DRM solution is so large that the w3c ran the risk of becoming an irrelevant standards body for this space if they didn't comply with what their members wanted to do. It's sub-optimal, but I don't think an optimal solution actually existed. A standards board divorced from reality is no better than no standard at all.
Touche 8y ago
> No, if the Director had overridden the majority of the membership, the browser vendors would've shipped something anyway That's fine. It's better that the burden for maintaining non-standard plugins be put on the sites and browsers that choose to do that, rather than be placed on everyone else.
- geofft 8y ago
  How would that have improved the current situation? The videos that Metastream wants to play would still have been DRM'd and would still be playable in the mainstream browsers. What would the benefit have been? What burden is being placed on people now that wouldn't be placed on people in that scenario?
  - AnthonyMouse 8y ago
    Making the user experience of DRM worse is better because then fewer people will use it. If the platforms all made it so that you have to solder a new chip into your phone before you can play DRM content, there would be a lot less DRM. The argument that platforms have to do this for competitive reasons is doublethink. If the experience is worse and that will cause customers to flee, how is it that they would only flee from the platforms that don't have DRM but not the content providers that require it? Wouldn't that create a huge market opportunity for new DRM-free studios, who would then out-compete the traditional ones by being available on all platforms instead of only on Insecure Expensive Proprietary Slow Cableco Platform Nobody Likes?
    - gsnedders 8y ago
      Would it have made the user experience of DRM any worse than it currently is, though? The DRM module would still ship with Chrome and Edge (and likely Safari too, given Apple became involved pretty quickly), you'd still need multiple different streaming formats (in the form of different DRM formats) as you do today, and maybe you'd need slightly different JS codepath per-browser too (but that's not a big difference to today with the different DRM formats). It's very unclear to me that the W3C refusing to be involved from day one would've led to any outcome very more than subtly different than the one we ended at. At the point that the specification went to Recommendation, there were already multiple interoperable implementations, so objecting at that point was purely a matter of principle, it literally wouldn't have affected the outcome in any way.
      - AnthonyMouse 8y ago
        If the W3C making the right decision would make them irrelevant then what has actually happened is that they're already irrelevant, and becoming a rubber stamp on bad ideas only serves to prove that and erode their credibility. Moreover, such organizations are made up of their members, and it's up to the members to do the right thing as well. Nobody had to volunteer to be the first to add this gunk to their browser. It can't be a competitive disadvantage if nobody else has it either, and it can't be a competitive advantage if everybody else has it, and those are the two options so why not choose the first?
- skybrian 8y ago
  It's funny how people try to make "standard" mean something magical when it's not. An Internet standard is just a document written by a committee of people who intend to do what it says. They then publicize it and try to get people to go along with it. You can't keep people from getting together to write a document or from doing what the document says. You can just choose whether to participate. If W3C chose not to help write the DRM standard, the browser vendors could easily create a new organization and write a standard anyway (as happened with WHATWG). Browser vendors and website authors could then read that document just as easily as anything published on the W3C website, so there is no "burden" for them. There would be no difference to the end user. The only burden we're talking about is the inconvenience of setting up an organization to do the writing. It's a minor speedbump at best. The upshot is that there is no way to prevent browser vendors from standardizing anything they want. It only gets blocked if they disagree.
  - Touche 8y ago
    No one is implying that not infecting W3C with DRM is going to kill DRM. Of course anyone can agree to things in whatever organized way they want to. The reason to keep it out of W3C is because it violates their core mission: https://www.w3.org/Consortium/mission#principles https://www.w3.org/Consortium/mission#principles . Other organizations with a different mission are free to do as they wish, obviously.
adl 8y ago
Welcome to the 21st

ohithereyou 8y ago

The W3C exists partly to take the blame off of its members for the decisions that they agree to unanimously. Blame the W3C members for their decision to screw the user.

gsnedders 8y ago
The W3C membership nowhere near unanimously approved the advancement of the EME specification to Recommendation; that much has been said publicly by various people over the course of the past few years. The majority of the membership was in favour, definitely, but it wasn't unanimous. Some members I think it's predictable how they voted (MPAA may have voted in favour, EFF may have voted against); others less so.

derefr 8y ago

It was never gonna happen; as soon as Intel introduced SGX, any DRM-producing company that wasn’t taking advantage of it would be seen as failing their shareholders. Even if Flash had died on schedule without browsers offering a native browser-DOM DRMed-content API, DRMed-content producers would just have jumped to another tech the DRM vendors sold them. My guess is that, if browser vendors wouldn’t have played ball, the DRM vendors would have worked with one of the JRE vendors to optimize the Java applet runtime, and contributed to performance improvements on the browser side for all the open browsers, such that “Java applet” would no longer be a scary heavy-weight thing nobody wants their browser to launch. That would be (one of) the implicit threats hanging over browser vendors: if you don’t cooperate, we’ll take your control over innovation on the web away by refocusing it on an improved Java experience.

AnthonyMouse 8y ago
How is that "threat" a problem? That sounds like an Old Microsoft objection to cross-platform code, but the web is already cross-platform code, so that doesn't make any sense. And if the browser vendors really didn't like it for unknown reasons then they could have just stopped supporting Java in the browser, as has largely already happened for various other reasons. This is one of those "we all must hang together or we shall all hang separately" situations, and they apparently decided they'd prefer to hang separately.

wolfgke 8y ago

> The blame for this sits squarely on the w3c for their efforts in trying to replace flash by letting the content companies dictate standards for encrypted playback. The blame for this sits squarely on the users for their tolerance of malware (which DRM is) in the browsers that they use.

monetus 8y ago
Do you think most users even know what drm is, or that it's being run?
- wolfgke 8y ago
  I tell it to my acquaintances all the time. Nearly all of them are not interested in this information.
  - suprfsat 8y ago
    They could be your friends if you'd stop.
  - monetus 8y ago
    I wonder how much of this is simply cognitive overload. I mean, climate change, crispr, ocean acidification, asteroids... I would guess that most people prioritize dopamine first and foremost. Software is arcane, so thinking about how it affects society probably seems irrelevant to them. Even if they do care, power dynamics make defeatism a logical and realistic mindset.
    - gowld 8y ago
      If you use Netflix as advertised, you don't need to know about DRM; it does its job without being noticeable. Netflix is a streaming service, not a movie store. There's no need for making backups. If you try to use Netflix outside the bounds of your agreement (like copying downloads to a different device), then the DRM becomes visible.

jcranmer 8y ago

Blame Google and Microsoft. They were the people who created the specification, and pushed for it, when Netflix came begging for a solution to their DRM conundrum. Even if the W3C hadn't approved it, that's two of the big four browser vendors who are committing to implementing it anyways, which is enough to guarantee a de facto standard anyways.

tiraniddo 8y ago
No, blame the movie studios, record labels etc. They're the one which require asinine DRM support for web browsers. Google/Microsoft/Apple/Adobe want to support media content, but to do so requires towing the line with the media companies otherwise they refuse to license the content (at least in HD+). Having worked with various DRM teams I know that they have to treat their code as if its the most secret code in the world, if they don't the media companies can swoop in and ban them and then no Netflix for your users. This is why Widevine code isn't open source (other than the glue EME code) and is almost certainly the reason for the refusal to work with a small open-source form of Chromium. If for example the project was used to "steal" content the media companies would be mad at Widevine, with lasting repercussions for all Chrome users. It's worth noting that typically all DRM teams work as if the hosting environment is an adversary. For example Widevine don't trust anything Chrome says as someone could recompile it and lie about the security. The only times this is relaxed is where the platform is deemed secure, such as CrOS or iOS.
- Zak 8y ago
  The weird thing about this is I can find a high-quality torrent for anything on Netflix in under a minute.
  - sabujp 8y ago
    DRM are like locks on a house, just keeps honest people out
    - gloflo 8y ago

Arnt 8y ago

I don't suppose you remember, but they did their key management in native code plugins 10-15 years ago. Silverlight and Flash both had DRM capability, IIRC. I've worked with that and it was no joy at all. Without W3C DRM they would have kept those plugins alive instead of deprecating them. I see no reason why they'd have migrated to webasm, webasm wouldn't provide the know-thy-customer aspect the DRM people want.

DCKing 8y ago

> The blame for this sits squarely on the w3c for their efforts in trying to replace flash by letting the content companies dictate standards for encrypted playback. It really isn't. The W3C at the very least permits a solution whereby content companies liberally distribute binary blobs for every platform under the sun. Hell, it even permits an open source solution that e.g. speaks directly to the DRM hardware in graphics chips (don't know if that would be technically feasible, don't shoot me). It doesn't have to be this way. In this context it's really specifically Google being assholes about this. They can choose to not be assholes about this. The fact that the W3C allows them to be assholes about this doesn't change the fact that Google is choosing to be this way about it.

sigi45 8y ago

How would have that worked? If you do not sign every single file per user, there is no real way to get something secure if you do not controle the whole processing pipeline.

GuB-42 8y ago

The W3C isn't to blame. No one is to blame, really. We have DRM, we hate it but it's there, and it serves a purpose. If it is your intellectual property, you get to decide how it is used. And if you don't want to make copying too easy because you think that it will get you more money, that's your right. The goal of the W3C is not to make to make a political statement about the rightness or wrongness of DRM. They are here to create standards that respond to use cases. And unfortunately, copyrighted content diffusion is one use case, and content owners want DRM. And if you read the standard they came up with, it is not that bad. They managed to isolate the "evil DRM" part well enough without completely destroying its effectiveness. They also didn't require any proprietary component, though services can require them (that's what happened in the article). Using WebAssembly (which is essentially optimized JS) for DRM is a terrible idea IMHO. DRM, to be effective, usually requires access to protected system components. It means that to make an effective enough DRM to be accepted by content providers (which is the entire point of the standard), we would need to give WebAssembly way to much power.

xg15 8y ago
The problem is that pretty much the only way to satisfy those obligations is to turn the internet into a huge walled garden (as is currently happening). So we'll either have to accept the consequences of that, decide that some of the rightsholders' claims described above are not in the public interest or find some kind of middle ground.
simias 8y ago
You make good points but: >And if you don't want to make copying too easy because you think that it will get you more money, that's your right. They seem to think that but is there any truth to it? I do pirate some series/movies from time to time (mostly out of convenience) and you can get high quality rips of pretty much anything mere hours after it's available on streaming sites anyway. So what is this DRM supposed to achieve? Prevent the average non-technical user from saving the stream? I mean I'm sure they wouldn't even know where to start, there's no "Save As" button on Netflix for instance. Simple client-side limitations would do the trick for 99.9% of the population. On the other hand the few technically-savvy stream rippers seem to have no issue bypassing these protections. DRM works better for interactive content like games because it's not just about ripping the output. How many decades do we have to suffer through this broken scheme and this technical debt until the right owners realize that they're wasting their time and their resources to push a system that only serves to make it harder for legit clients to consume their contents? When iTunes got rid of DRM on music files I thought it would be the tipping point where right owners would realize that this scheme was ineffective and counter-productive, but apparently it's still an industry standard for some reason. Have legit users on unsupported systems stream low-res video while the pirates can watch it in 4k for free. Ridiculous.

deleted 8y ago

[deleted]

908087 8y ago

Tim Berners-Lee's Google-funded $1M Turing award sure smelled like a payoff to me. If it wasn't, the timing sure was convenient.