6 ms·

How exactly would DRM for HTML5 work? Couldn't I just fork Chronimum or Firefox and make the browser save the video content in a file rather than showing it?

by Drakim 14y ago

cleverjake 14y ago
It doesn't exist yet, so no. But the crux of the issue is making that not possible...somehow.
nwh 14y ago
It wouldn't. DRM relies on obfuscation, and open source software obviously can't have that. They'll probably write a horribly insecure Silverlight plugin that will be cracked in a matter of minutes. ED: It looks like they'll have a "plugin" that does authentication with a remote server, and then decodes the frames sent to it. The browser displays them, or the DRM removal software sniffs the keys and decrypts the content anyway. This is how they think it will work [1], and the full proposal [2] [1]: https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-media/stack_overview.png https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-med... [2]: https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-media/encrypted-media-fpwd.html https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-med...
- alanctgardner2 14y ago
  > a horribly insecure Silverlight plugin This is about the HTML5 spec, so I don't even know where you get that idea from. They want to be able to lock down content which is embedded with the video tag. Personally, I don't like the idea of it tying into the operating system. I'm willing to accept any solution that can be built into browser binaries, cross-platform. I don't like the idea of a solution that doesn't work as well on Linux or Macs, but if media companies think this sort of solution is necessary, we should meet them half-way.
  - betterunix 14y ago
    "if media companies think this sort of solution is necessary, we should meet them half-way." Or we could not meet them half-way and remind them that they do not own the web and that their business model is as out of date as Kodak. Why should we accept any more attacks on the freedom and openness of the web or the greater Internet? This companies are the ones who need to change: they need to adapt their businesses to the realities of this century's technology.
    - gph 14y ago
      > they need to adapt their businesses to the realities of this century's technology. You say this like it's immensely easy. So say you're head of HBO's original programming dept. It can cost over 100 million dollars to produce one season of a quality show. You can only release it on a medium that allows it to be continuously and freely distributed. How do you make money? Ads and Product placement is about it. You really think you'll make that 100 million back?? Especially considering that people could just edit out the ads and redistribute your work, it's really only product placement that could make money. Operating at a loss is not adapting. There's a reason that all of the content currently on netflix/hulu/etc. is already using DRM-enabled plugins. Because you're a f*ing lunatic if you think you can make money through any other method. Throwing out the same old "they must adapt" mantra isn't getting either side anywhere close to a healthy solution.
      - noahl 14y ago
        Actually, this is about how music works nowadays. You can download DRM-free files for a small fee. It would be technically easy to redistribute them, but people still buy lots of music. Why is that? I think it's because people are making a price-convenience tradeoff. Music companies can affect both sides of that: keeping the price low will make people want to buy, but they can also sue distribution sites to make it less convenient to get music illegally, thus raising the price that people are willing to pay before they seek out illegal music. To a certain extent, DRM aims for the same model - it doesn't make it impossible to redistribute videos, it just raises the difficulty, and thus raises the price that people are willing to pay before they go find illegal videos. But is it necessary to use DRM for that, or would going after distribution sites be enough?
  - nwh 14y ago
    > This is about the HTML5 spec You're right, I got my wires crossed until I found the page with the spec on it (the first edit). The end result is even worse; every computer has an obfuscated binary that does unknown things with media served to it. Sounds like the recipe for wide-scale pwnage to me.
- cmircea 14y ago
  So why can't the browser save the frames then? That's not DRM.
  - ferongr 14y ago
    The proposal is (probably by design) very vague at this moment but it's possible the platform-specific CDM binary could bypass the browser completely and paint a programmatically inaccessible overlay over the video element, using standard OS protected paths.
acdha 14y ago
I think it's more that you'd move the technology out a level - take the same fantasy-ware which is currently in Flash or Silverlight and allow IE or Safari to call it directly. The OSS versions presumably wouldn't get this and would be unable to play such content. Imagine <video> started accepting QuickTime or Windows Media content and passing it directly to the OS framework for decoding & rights control. I'm in favor of the idea: if we are to have DRM – and there's no sign of the legal sea-change necessary to change that – it might as well be something which doesn't spread a binary plugin with a huge attack surface around much of the web.
yk 14y ago
Very simple, there will be a bitmap* decrypt_video(char* url, int intent); somewhere in the source. If you intend to watch it, then you call it as content=decrypt_video(url, INTENTION_VIEW); while in case of piracy you call it as content=decrypt_video(url, INTENTION_COPY); The constants INTENTION_COPY and INTENTION_VIEW are just redefinition of the constants provided to implement RFC 3514 [1]. So it is easy to use on any system providing an standard compliant IP stack. [1]https://www.ietf.org/rfc/rfc3514.txt https://www.ietf.org/rfc/rfc3514.txt
bzbarsky 14y ago
You can already do that with the DRM in Silverlight, say....

How exactly would DRM for HTML5 work? Couldn't I just fork Chronimum or Firefox and make the browser save the video content in a file rather than showing it?

by Drakim 14y ago

How exactly would DRM for HTML5 work? Couldn't I just fork Chronimum or Firefox and make the browser save the video content in a file rather than showing it?

cleverjake 14y ago

It doesn't exist yet, so no. But the crux of the issue is making that not possible...somehow.

nwh 14y ago

It wouldn't. DRM relies on obfuscation, and open source software obviously can't have that. They'll probably write a horribly insecure Silverlight plugin that will be cracked in a matter of minutes. ED: It looks like they'll have a "plugin" that does authentication with a remote server, and then decodes the frames sent to it. The browser displays them, or the DRM removal software sniffs the keys and decrypts the content anyway. This is how they think it will work [1], and the full proposal [2] [1]: https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-media/stack_overview.png https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-med... [2]: https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-media/encrypted-media-fpwd.html https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-med...

alanctgardner2 14y ago
> a horribly insecure Silverlight plugin This is about the HTML5 spec, so I don't even know where you get that idea from. They want to be able to lock down content which is embedded with the video tag. Personally, I don't like the idea of it tying into the operating system. I'm willing to accept any solution that can be built into browser binaries, cross-platform. I don't like the idea of a solution that doesn't work as well on Linux or Macs, but if media companies think this sort of solution is necessary, we should meet them half-way.
- betterunix 14y ago
  "if media companies think this sort of solution is necessary, we should meet them half-way." Or we could not meet them half-way and remind them that they do not own the web and that their business model is as out of date as Kodak. Why should we accept any more attacks on the freedom and openness of the web or the greater Internet? This companies are the ones who need to change: they need to adapt their businesses to the realities of this century's technology.
  - gph 14y ago
    > they need to adapt their businesses to the realities of this century's technology. You say this like it's immensely easy. So say you're head of HBO's original programming dept. It can cost over 100 million dollars to produce one season of a quality show. You can only release it on a medium that allows it to be continuously and freely distributed. How do you make money? Ads and Product placement is about it. You really think you'll make that 100 million back?? Especially considering that people could just edit out the ads and redistribute your work, it's really only product placement that could make money. Operating at a loss is not adapting. There's a reason that all of the content currently on netflix/hulu/etc. is already using DRM-enabled plugins. Because you're a f*ing lunatic if you think you can make money through any other method. Throwing out the same old "they must adapt" mantra isn't getting either side anywhere close to a healthy solution.
    - noahl 14y ago
      Actually, this is about how music works nowadays. You can download DRM-free files for a small fee. It would be technically easy to redistribute them, but people still buy lots of music. Why is that? I think it's because people are making a price-convenience tradeoff. Music companies can affect both sides of that: keeping the price low will make people want to buy, but they can also sue distribution sites to make it less convenient to get music illegally, thus raising the price that people are willing to pay before they seek out illegal music. To a certain extent, DRM aims for the same model - it doesn't make it impossible to redistribute videos, it just raises the difficulty, and thus raises the price that people are willing to pay before they go find illegal videos. But is it necessary to use DRM for that, or would going after distribution sites be enough?
- nwh 14y ago
  > This is about the HTML5 spec You're right, I got my wires crossed until I found the page with the spec on it (the first edit). The end result is even worse; every computer has an obfuscated binary that does unknown things with media served to it. Sounds like the recipe for wide-scale pwnage to me.
cmircea 14y ago
So why can't the browser save the frames then? That's not DRM.
- ferongr 14y ago
  The proposal is (probably by design) very vague at this moment but it's possible the platform-specific CDM binary could bypass the browser completely and paint a programmatically inaccessible overlay over the video element, using standard OS protected paths.

acdha 14y ago

I think it's more that you'd move the technology out a level - take the same fantasy-ware which is currently in Flash or Silverlight and allow IE or Safari to call it directly. The OSS versions presumably wouldn't get this and would be unable to play such content. Imagine <video> started accepting QuickTime or Windows Media content and passing it directly to the OS framework for decoding & rights control. I'm in favor of the idea: if we are to have DRM – and there's no sign of the legal sea-change necessary to change that – it might as well be something which doesn't spread a binary plugin with a huge attack surface around much of the web.

yk 14y ago

Very simple, there will be a bitmap* decrypt_video(char* url, int intent); somewhere in the source. If you intend to watch it, then you call it as content=decrypt_video(url, INTENTION_VIEW); while in case of piracy you call it as content=decrypt_video(url, INTENTION_COPY); The constants INTENTION_COPY and INTENTION_VIEW are just redefinition of the constants provided to implement RFC 3514 [1]. So it is easy to use on any system providing an standard compliant IP stack. [1]https://www.ietf.org/rfc/rfc3514.txt https://www.ietf.org/rfc/rfc3514.txt

bzbarsky 14y ago

You can already do that with the DRM in Silverlight, say....