4 ms·

Remember when Flash was becoming ubiquitous? Here's a primary concern of mine: Many people think this means Netflix will continue to be DRM-ed, YouTube will g

Remember when Flash was becoming ubiquitous? Here's a primary concern of mine: Many people think this means Netflix will continue to be DRM-ed, YouTube will gain DRM-ed for-pay channels, etc. AKA premium video. (Oh, and audio -- nearly forgot that.) Once the tool is available, baked in, I fear a wholesale run to DRM-ed content. This will certainly be at least tried as the solution to the revenue problem. I'll add that, aside from the implications for an "open Net", I also worry about the security implications: We'll be forced to take without inspection whatever an encrypted provider sees fit to deliver or falls prey to. No, thanks.

rainforest 14y ago
None of the nightmare scenarios are enabled by this proposal that aren't already possible though. Flash is available and baked in, providers can already run to DRM-ed content since the ubiquitous platform enables it. It's currently used in part as the solution to the revenue problem. All these problems already exist, mostly because of Flash. We still have to accept without inspection whatever Adobe sees fit to deliver (which leads to terrible results). All this proposal really represents is an opportunity to unseat Flash and replace it with a more accountable party to complain to when a device you own can't play the content you buy.
- pornel 14y ago
  EME is worse than the current situation, because it removes Adobe and Microsoft standing between MPAA's desires and your computer. At least Microsoft and Adobe would refuse to implement DRM that is too user-hostile in order to save their eroding reputation and install base. But with EME you have to run whatever binary Netflix tells you to install, and that will do whatever people who pull the strings on Netflix want.
  - rainforest 14y ago
    That is a valid point, but I think some power is still retained by the consumer in the sense that they can reject individual DRM implementations and accept others, while with Flash they're forced to install it if one provider they wish to use requires it. The point of user-hostility is the only point that is an obvious problem to me; if the CDM was sandboxed and had a very limited set of access beyond it - pretty much the same environment provided by Flash - I'd be happy.
beaumartinez 14y ago
The alternative is that people will continue to use Flash, an even more obscure (and not to mention closed) format, which we are forced to take with even less inspection. At least with <video> the only thing encrypted will be the actual video file.
- lmm 14y ago
  Many sources provide a flash player that itself obtains the video via a completely open stream - in fact, I haven't seen anyone using encrypted video files on the web. So for practical purposes the current situation is better.
- pornel 14y ago
  Note that EME is an interface for arbitrary DRM plug-ins (CDMs) that could be implemented on system/kernel/hardware level. Flash and Silverlight at least live in userland and have public API (NPAPI). AFAIK using them in your own browser is not a DMCA violation. OTOH EME deliberately does not define any API between browser and CDMs, so DRM vendors have opportunity to license CDMs to selected browser vendors and make playback with "unapproved" browsers (e.g. your own open-source build) a DMCA violation.
wmf 14y ago
How does DRM solve "the revenue problem"? If you're currently distributing non-DRMed video for free, wrapping it in DRM won't create money out of nowhere. Are you talking about ad-blocker-blockers or something?
- pasbesoin 14y ago
  Flash was (and is, but I think the prevalence is declining or at least growth has slowed or stopped) used to deliver much content that I would consider to be or in the nature of being (before ginned up) static. (Perhaps not the best example with respect to my concern here, but one widely cited example of this: Flash to view the menu of a restaurant I'm interested in or scheduled to visit.) I fear a DRM mechanism in the standard (and so, with broad, built-in deployment) will be used the same way. You won't get any content without enabling the DRM, and whatever payment mechanism is associated with that. Whether subscription, or ads. And while I'm not adverse to useful, non-intrusive, safe ads, we've yet to see those realized in a consistent and reliable manner. With DRM, content can be inextricably tied to bad, exploitative, and unsafe ads. It's not what one thinks it will be used for. It's whatever a developer can twist it to do. What I find to be similar arguments exist for e.g. not permitting the government to backdoor communications and security systems. It's not always the overt use we worry about; it's often the covert use, whether by government or by third parties. P.S. I'll add that I'm not a technical expert in this particular area. But, I tend to suspect -- or regardless, look for -- the worst, and I often end up finding it. And doing that in technical environments has been a significant part of my career, where I've done quite well at finding and solving problems before they cause catastrophes (or, as the case may be, after). TL;DR: I fear this baked in DRM as a closed channel for any and all sorts of dangerous as well as annoying crap and behavior. I'm not claiming to have a solution to all the current woes. But I don't see this going in the right direction.
  - pornel 14y ago
    EME spec covers only a JS API for metadata exchange with unspecified magical CDM plugins. The spec deliberately doesn't cover how CDM gets integrated with the browser (currently: you're Google and you make a deal with Netflix privately and get binary to bake into closed version of ChromeOS). * It might be that CDMs will be shipped with the OS (Widevine in Android/ChromeOS, WMDRM in Windows, FairPlay in OS X) and you'll have to rent licensing servers from each vendor. * It might be that browser vendors will allow ActiveX-like download or allow regular .exe installers add components to the system and you'll have convince viewers that you're not giving them a virus. * Or it might be that major browser vendors will license Netflix DRM, Hulu DRM, Amazon DRM and that's it. In either case if you're a small player, you probably won't be able to use the DRM. The only option for you will be the default ClearKey which is as pathetic as the name implies. It can be broken with: javascript:MediaKeys.prototype.update = function(key){alert("game over " + key)}

rainforest 14y ago

None of the nightmare scenarios are enabled by this proposal that aren't already possible though. Flash is available and baked in, providers can already run to DRM-ed content since the ubiquitous platform enables it. It's currently used in part as the solution to the revenue problem. All these problems already exist, mostly because of Flash. We still have to accept without inspection whatever Adobe sees fit to deliver (which leads to terrible results). All this proposal really represents is an opportunity to unseat Flash and replace it with a more accountable party to complain to when a device you own can't play the content you buy.

pornel 14y ago
EME is worse than the current situation, because it removes Adobe and Microsoft standing between MPAA's desires and your computer. At least Microsoft and Adobe would refuse to implement DRM that is too user-hostile in order to save their eroding reputation and install base. But with EME you have to run whatever binary Netflix tells you to install, and that will do whatever people who pull the strings on Netflix want.
- rainforest 14y ago
  That is a valid point, but I think some power is still retained by the consumer in the sense that they can reject individual DRM implementations and accept others, while with Flash they're forced to install it if one provider they wish to use requires it. The point of user-hostility is the only point that is an obvious problem to me; if the CDM was sandboxed and had a very limited set of access beyond it - pretty much the same environment provided by Flash - I'd be happy.

beaumartinez 14y ago

The alternative is that people will continue to use Flash, an even more obscure (and not to mention closed) format, which we are forced to take with even less inspection. At least with <video> the only thing encrypted will be the actual video file.

lmm 14y ago
Many sources provide a flash player that itself obtains the video via a completely open stream - in fact, I haven't seen anyone using encrypted video files on the web. So for practical purposes the current situation is better.
pornel 14y ago
Note that EME is an interface for arbitrary DRM plug-ins (CDMs) that could be implemented on system/kernel/hardware level. Flash and Silverlight at least live in userland and have public API (NPAPI). AFAIK using them in your own browser is not a DMCA violation. OTOH EME deliberately does not define any API between browser and CDMs, so DRM vendors have opportunity to license CDMs to selected browser vendors and make playback with "unapproved" browsers (e.g. your own open-source build) a DMCA violation.

wmf 14y ago

How does DRM solve "the revenue problem"? If you're currently distributing non-DRMed video for free, wrapping it in DRM won't create money out of nowhere. Are you talking about ad-blocker-blockers or something?

pasbesoin 14y ago
Flash was (and is, but I think the prevalence is declining or at least growth has slowed or stopped) used to deliver much content that I would consider to be or in the nature of being (before ginned up) static. (Perhaps not the best example with respect to my concern here, but one widely cited example of this: Flash to view the menu of a restaurant I'm interested in or scheduled to visit.) I fear a DRM mechanism in the standard (and so, with broad, built-in deployment) will be used the same way. You won't get any content without enabling the DRM, and whatever payment mechanism is associated with that. Whether subscription, or ads. And while I'm not adverse to useful, non-intrusive, safe ads, we've yet to see those realized in a consistent and reliable manner. With DRM, content can be inextricably tied to bad, exploitative, and unsafe ads. It's not what one thinks it will be used for. It's whatever a developer can twist it to do. What I find to be similar arguments exist for e.g. not permitting the government to backdoor communications and security systems. It's not always the overt use we worry about; it's often the covert use, whether by government or by third parties. P.S. I'll add that I'm not a technical expert in this particular area. But, I tend to suspect -- or regardless, look for -- the worst, and I often end up finding it. And doing that in technical environments has been a significant part of my career, where I've done quite well at finding and solving problems before they cause catastrophes (or, as the case may be, after). TL;DR: I fear this baked in DRM as a closed channel for any and all sorts of dangerous as well as annoying crap and behavior. I'm not claiming to have a solution to all the current woes. But I don't see this going in the right direction.
- pornel 14y ago
  EME spec covers only a JS API for metadata exchange with unspecified magical CDM plugins. The spec deliberately doesn't cover how CDM gets integrated with the browser (currently: you're Google and you make a deal with Netflix privately and get binary to bake into closed version of ChromeOS). * It might be that CDMs will be shipped with the OS (Widevine in Android/ChromeOS, WMDRM in Windows, FairPlay in OS X) and you'll have to rent licensing servers from each vendor. * It might be that browser vendors will allow ActiveX-like download or allow regular .exe installers add components to the system and you'll have convince viewers that you're not giving them a virus. * Or it might be that major browser vendors will license Netflix DRM, Hulu DRM, Amazon DRM and that's it. In either case if you're a small player, you probably won't be able to use the DRM. The only option for you will be the default ClearKey which is as pathetic as the name implies. It can be broken with: javascript:MediaKeys.prototype.update = function(key){alert("game over " + key)}