3 ms·

Its all about the DRM. Flash is the only viable way of streaming with enough protection that keeps rights-holders happy :( Video on the web would be a lot simp

Its all about the DRM. Flash is the only viable way of streaming with enough protection that keeps rights-holders happy :( Video on the web would be a lot simpler if DRM/content protection would die die die...

threedaymonk 14y ago
I'm not even convinced that these supremely ignorant "rights holders" really exist, except in scary tales handed down from one generation to the next. I mean, surely they don't think their "protection" is actually working, do they? Have they never been on the internet? RTMPE was cracked years ago (the handshaking consists of little more than sending an HMAC of a magic string and the player file)[1]. It's all just obfuscation. Putting a transparent layer over the video and obfuscating the file name will achieve the same effect, that is, preventing casual downloads. That's all they've got at the moment, even with Flash "DRM". 1. http://lkcl.net/rtmp/RTMPE.txt http://lkcl.net/rtmp/RTMPE.txt
- objclxt 14y ago
  "I'm not even convinced that these supremely ignorant "rights holders" really exist, except in scary tales handed down from one generation to the next" I do some work in the mobile space around rights protected video. Trust me, they exist. Particularly if the content you're handling isn't on public release yet.
- Rabidgremlin 14y ago
  Oh they exist believe me... Working with a local broadcaster you run into all sorts of things like: 1) You didn't buy the streaming rights 2) You can only put it on line X days after broadcasting it 3) You can only keep it online for X days 4) All data packets sent to user must be transient, encrypted and not cacheable (that's a fun one to try get right ) 5) etc etc etc
- PeterisP 14y ago
  They do exist; and the rules basically amount "use a whitelisted DRM solution or don't get our content". A solution that you believe to be good and secure but that they haven't validated can't be used; and that validation takes significant time and money. And you can't really force your terms on DRM unless you are Apple - even multinational cable companies (that have been distributing the same content on cable for decades) have the same problems for any IP-based transmission, even for them the content providers have all the trumps, and any changes can be negotiated (paying a lot for removing each restriction) only with the next round of content deals every 3-5 years or so.
stephengillie 14y ago
This is just because html5 doesn't have a way of hiding the video stream from the html source, right? Hasn't anyone figured out how to proxy it, or only allow a connection to the hosting server if the browser has a specific cookie, or some other way of obfuscating the video's URL?
- wmf 14y ago
  I'm sure there are JS-based obfuscation techniques, but Hollywood's approval process is probably highly political. So developing fake HTML5 DRM costs X, but getting it approved may cost zero (if you're Steve Jobs), 10X, 100X, or infinity.
objclxt 14y ago
Yes - the problem really lies with the rights holders here. Because when constrained by the restrictions put in place by content holders you're really faced with two options for mobile DRM video: use Flash (which few devices support, and none well), or use a native app (Netflix, etc). But since it's rather unlikely a DRM solution through the <video> tag is going to be supported by all (any?) browser vendors, the buck really does stop with the rights holders.
wwweston 14y ago
> Flash is the only viable way of streaming with enough protection that keeps rights-holders happy :( Silverlight seems to work out for Netflix. > Video on the web would be a lot simpler if DRM/content protection would die die die... Let's say it did. What web standard (particularly that IE10 implements) makes it relatively easy to implement even non-protected streaming?
- w1ntermute 14y ago
  > Silverlight seems to work out for Netflix. Silverlight doesn't run on Android or iOS either, so I don't see how it's an improvement over Flash in this regard.
  - MatthewPhillips 14y ago
    Silverlight doesn't run in IE10 Metro either (Or Windows Phone). http://www.geek.com/articles/news/internet-explorer-10-metro-will-not-support-flash-silverlight-20110915/ http://www.geek.com/articles/news/internet-explorer-10-metro...
- okaramian 14y ago
  So, having teams rewrite everything for a different proprietary framework because people "don't like Flash" is somehow a viable alternative?
- wmf 14y ago
  What web standard (particularly that IE10 implements) makes it relatively easy to implement even non-protected streaming? HTML5 (video tag), H.264, and (coming soon) DASH.
  - okaramian 14y ago
    Only progressive delivery if you're talking about IE10.
cjbos 14y ago
HBO and pretty much any major Network all have iOS apps. HLS streaming can be protected, you can encrypt the chunks and decrypt on the player. Ironically enough for my previous job I built a HLS prototype solution that did exactly this... in the Flash Player.
- MatthewPhillips 14y ago
  > HBO and pretty much any major Network all have iOS apps. What does that have to do with anything?
- jiggy2011 14y ago
  Did you find that approach to be effective at all? If you are decrypting on the player then the decryption key must be on the clients device. What is to stop them grabbing the key from memory and ripping the stream anyway?
  - cjbos 14y ago
    Yeah, it was just a prototype to protect live video streaming on Android devices... Performance was pretty bad and so the frame rate was pretty low. I think it would work decently for desktop Flash. JW Player have a HLS plugin for Flash which is pretty good, a lot more fleshed out than my prototype ended up being. Apple do something similar http://developer.apple.com/library/ios/#documentation/NetworkingInternet/Conceptual/StreamingMediaGuide/UsingHTTPLiveStreaming/UsingHTTPLiveStreaming.html#//apple_ref/doc/uid/TP40008332-CH102-DontLinkElementID_22 http://developer.apple.com/library/ios/#documentation/Networ... this approach is more secure than what we de (Restrict access to the manifest file and have Flash request the current key when needed at runtime).
    - jiggy2011 14y ago
      I can see that that could work on a locked down iOS device but a rooted android phone would surely be able to access to manifest file and make a copy of the keys and stream contents. After all you only need one device to copy the stream and re-stream DRM free to others.

threedaymonk 14y ago

I'm not even convinced that these supremely ignorant "rights holders" really exist, except in scary tales handed down from one generation to the next. I mean, surely they don't think their "protection" is actually working, do they? Have they never been on the internet? RTMPE was cracked years ago (the handshaking consists of little more than sending an HMAC of a magic string and the player file)[1]. It's all just obfuscation. Putting a transparent layer over the video and obfuscating the file name will achieve the same effect, that is, preventing casual downloads. That's all they've got at the moment, even with Flash "DRM". 1. http://lkcl.net/rtmp/RTMPE.txt http://lkcl.net/rtmp/RTMPE.txt

objclxt 14y ago
"I'm not even convinced that these supremely ignorant "rights holders" really exist, except in scary tales handed down from one generation to the next" I do some work in the mobile space around rights protected video. Trust me, they exist. Particularly if the content you're handling isn't on public release yet.
Rabidgremlin 14y ago
Oh they exist believe me... Working with a local broadcaster you run into all sorts of things like: 1) You didn't buy the streaming rights 2) You can only put it on line X days after broadcasting it 3) You can only keep it online for X days 4) All data packets sent to user must be transient, encrypted and not cacheable (that's a fun one to try get right ) 5) etc etc etc
PeterisP 14y ago
They do exist; and the rules basically amount "use a whitelisted DRM solution or don't get our content". A solution that you believe to be good and secure but that they haven't validated can't be used; and that validation takes significant time and money. And you can't really force your terms on DRM unless you are Apple - even multinational cable companies (that have been distributing the same content on cable for decades) have the same problems for any IP-based transmission, even for them the content providers have all the trumps, and any changes can be negotiated (paying a lot for removing each restriction) only with the next round of content deals every 3-5 years or so.

stephengillie 14y ago

This is just because html5 doesn't have a way of hiding the video stream from the html source, right? Hasn't anyone figured out how to proxy it, or only allow a connection to the hosting server if the browser has a specific cookie, or some other way of obfuscating the video's URL?

wmf 14y ago
I'm sure there are JS-based obfuscation techniques, but Hollywood's approval process is probably highly political. So developing fake HTML5 DRM costs X, but getting it approved may cost zero (if you're Steve Jobs), 10X, 100X, or infinity.

objclxt 14y ago

Yes - the problem really lies with the rights holders here. Because when constrained by the restrictions put in place by content holders you're really faced with two options for mobile DRM video: use Flash (which few devices support, and none well), or use a native app (Netflix, etc). But since it's rather unlikely a DRM solution through the <video> tag is going to be supported by all (any?) browser vendors, the buck really does stop with the rights holders.

wwweston 14y ago

> Flash is the only viable way of streaming with enough protection that keeps rights-holders happy :( Silverlight seems to work out for Netflix. > Video on the web would be a lot simpler if DRM/content protection would die die die... Let's say it did. What web standard (particularly that IE10 implements) makes it relatively easy to implement even non-protected streaming?

w1ntermute 14y ago
> Silverlight seems to work out for Netflix. Silverlight doesn't run on Android or iOS either, so I don't see how it's an improvement over Flash in this regard.
- MatthewPhillips 14y ago
  Silverlight doesn't run in IE10 Metro either (Or Windows Phone). http://www.geek.com/articles/news/internet-explorer-10-metro-will-not-support-flash-silverlight-20110915/ http://www.geek.com/articles/news/internet-explorer-10-metro...
okaramian 14y ago
So, having teams rewrite everything for a different proprietary framework because people "don't like Flash" is somehow a viable alternative?
wmf 14y ago
What web standard (particularly that IE10 implements) makes it relatively easy to implement even non-protected streaming? HTML5 (video tag), H.264, and (coming soon) DASH.
- okaramian 14y ago
  Only progressive delivery if you're talking about IE10.

cjbos 14y ago

HBO and pretty much any major Network all have iOS apps. HLS streaming can be protected, you can encrypt the chunks and decrypt on the player. Ironically enough for my previous job I built a HLS prototype solution that did exactly this... in the Flash Player.

MatthewPhillips 14y ago
> HBO and pretty much any major Network all have iOS apps. What does that have to do with anything?
jiggy2011 14y ago
Did you find that approach to be effective at all? If you are decrypting on the player then the decryption key must be on the clients device. What is to stop them grabbing the key from memory and ripping the stream anyway?
- cjbos 14y ago
  Yeah, it was just a prototype to protect live video streaming on Android devices... Performance was pretty bad and so the frame rate was pretty low. I think it would work decently for desktop Flash. JW Player have a HLS plugin for Flash which is pretty good, a lot more fleshed out than my prototype ended up being. Apple do something similar http://developer.apple.com/library/ios/#documentation/NetworkingInternet/Conceptual/StreamingMediaGuide/UsingHTTPLiveStreaming/UsingHTTPLiveStreaming.html#//apple_ref/doc/uid/TP40008332-CH102-DontLinkElementID_22 http://developer.apple.com/library/ios/#documentation/Networ... this approach is more secure than what we de (Restrict access to the manifest file and have Flash request the current key when needed at runtime).
  - jiggy2011 14y ago
    I can see that that could work on a locked down iOS device but a rooted android phone would surely be able to access to manifest file and make a copy of the keys and stream contents. After all you only need one device to copy the stream and re-stream DRM free to others.