6 ms·
How will this work with open-source browsers like Firefox? After all, what's to stop somebody from publishing an extension or even a modified version of the bro
by tikhonj 13y ago
How will this work with open-source browsers like Firefox? After all, what's to stop somebody from publishing an extension or even a modified version of the browser itself? DRM seems fundamentally unenforceable, after all.
Are the people pushing for this hoping it's just too much hassle?
These questions aren't rhetorical: I'm interested in what exactly the DRM people are pushing and how they expect it to work. Just not interested enough to read about it myself :D. (Also, I think this makes for a great conversation topic.)
- jeremiep 13y agoMost likely there was a lot of lobbying for this to happen. People with big money but no clue about how the internet really works. I'm quite surprised to see Tim Berners-Lee approve this in fact, I wonder what made him say yes to this.
- marshray 13y agoWe should watch closely what his career does next.
- dubcanada 13y agoIt's actually mostly Netflix wanting this. They don't want to rely on SilverLight forever.
- nitrogen 13y agoAt least Sliverlight works in Linux with netflix-desktop.
- ryanthejuggler 13y agoThat stopped working for me several months ago... IIRC Netflix needed an updated version of Silverlight. Have they patched it?
- nitrogen 13y agoYeah, still works for me. It was only gone for a few days IIRC.
- dethstar 13y agoDRM people are not interested in how it'll work, in fact DRM often contributes to user of whatever it is implemented in suffering. They just want permission to insert their cluster fuck to keep getting rich.
- fafner 13y agoThey want to propose an API which would allow proprietary closed source binary blobs to display videos. In other words: They are pushing "yet another Flash" into HTML5.
- asadotzler 13y agoA "Flash" without the (in)security footprint of an entire runtime duplicating Web standards, I think you mean.
- nitrogen 13y agoAt least Flash was used widely enough that the vulnerabilities were found. EME means there are several competing vendors of proprietary DRM plugins that talk directly to video card drivers, all with unknowable security characteristics.
- fafner 13y agoWith the insecurity of being a closed source binary blob that has to duplicate a lot of the Web standard.
- sliverstorm 13y agoA better Flash? Yes, please, and thank you.
- fafner 13y agoNot a better Flash. The same crap but this time embedded in what used to be an open web standard.
- balabaster 13y agoI'm curious how with the whole open source community how this will be at all enforceable... there's nothing stopping me releasing a browser that says "To hell with DRM, I'm just not going to enforce any of it"... and because it's open source and out there in the wild, there's not a whole hell of a lot anyone can do to shut it down...
- Touche 13y agoThe browser doesn't enforce the DRM, a binary blob in the OS does.
- schoen 13y agoSee my comment upthread about encrypted media and how licensing is used to control the availability of decryption keys. In existing DRM people are not required to implement it, but they can't achieve interoperability without the decryption keys.
- betterunix 13y agoThe idea is that the browser is going to ask some lower-level DRM system to decode everything, only displaying it to the user. In theory this is supposed to go all the way down to the TPM, so that you cannot subvert it with a debugger or rootkit. In practice, there will probably be bugs that lead to video streams being captured anyway, and the whole thing will only serve to further divide people and make free software harder to use.
- Touche 13y agoDRM is not in the browser. The browser just acts as a gateway to allow the website to talk to a DRM component in the OS (or potentially in hardware).
- AlexanderDhoore 13y agoTake for example a DRM protected video. That video is being send to the framebuffer of my video card. If I use an open source OS and open source Browser, what on earth is stopping me from capturing that video output?
- Touche 13y agoThe website targets specific DRM schemes that they approve. Since your open source OS doesn't have any DRM schemes you're SOL.
- deleted 13y ago[deleted]
- gnoway 13y agoNothing, which is why this whole proposal even exists. With this standardized, we will continue to be legally and/or practically blocked from native consumption of protected content on general purpose GNU/Linux distributions.
- jrockway 13y agoAbsolutely nothing. DRM is pointless. Everything ever published in video form is already available to pirate. DRM just makes lawyers happy. I say, let them eat cake.
- ferongr 13y agoOpen source OSes will probably not have CDMs available, except when prepackaged into a proprietary widget (Android, ChromeOS, B2G is Mozilla decides to play ball)
- 13y ago
- mikeryan 13y agoThe DRM isn't actually implemented by the browser its more of a plugin architecture (Encrypted Media Extensions) which commercial closed source DRM plugin can fill.
- Pxtl 13y agoIf it's just going to end-up plug-ins, I don't understand why DRM is being treated specifically at all instead of tweaks to the existing general-purpose plug-in architecture. If you want DRM, deal with Microsoft Silverlight or Adobe Flash or roll your own.
- mikeryan 13y agoYou can, of course folks have, but then you can't use the video/audio tags. (or you need a pretty significant js shim)
- chinpokomon 13y agoBut this still effectively limits the rendering of content to blessed implementations. Why introduce a standard that isn't open when there are already other options.
- akjj 13y agoThe existing plugins are heavy and don't integrate well with other web technologies. In addition, the NPAPI interface is not standardized (I believe). Thus, the point is to narrow down the scope of plugins from everything that Flash and Silverlight do to just a piece of code focused on DRM. Everything else that people use Flash and Silverlight can be replaced by standards and directly implemented in the browser. However, DRM, by its nature depends on closed-source compiled binaries, which means that it has to remain in a plug-in.
- drzaiusapelord 13y agoI imagine the client-side stuff won't really matter. I think in the end there will be a DRM API that will not trust the client. "Does this user have a valid key or username/pass to access this content" won't be answered on the client-side, but on the server-side. Probably with a client-side file (or binary?) that gets delivered to the browser from the server and accessed locally in a sandboxed environment. This handles keys, auth, etc natively with the browser. This might be seamless to the end user. Probably easily crackable like, say SteamWorks, but good enough to keep low-hanging fruit safe and copyright holders happy as we begin to retire flash entirely. Joe User won't be able to 'right-click and saveas' but he'll be able to view HTML5 video. I think TBL is stuck between a rock and a hard place, just like Gabe Newell was with Steam. Users hate DRM, but he can't sell games without it. Some crowd-happy DRM scheme that's unobtrusive might be the only winning move here.
- schoen 13y agoIn most DRM systems the information is distributed encrypted. The decryption keys are given to technology developers who have specifically promised to obey the DRM rules, as well as to make their technology hard for users to understand or modify so that the users can't easily undo the restrictions or extract the decryption keys. Hence a browser developer or OS developer or developer of whatever software is in question wouldn't be permitted (by the DRM system's inventor or administrator) to get decryption keys if they didn't promise to implement these restrictions. Some of the people who invented the modern DRM business ecology called this "the intersection of technology, law, and commercial licensing" (the title of a 1996 article by Dean Marks and Bruce Turnbull). Here, the "technology" is DRM implementations -- including software obfuscation and other measures; the "law" is anticircumvention laws like the DMCA §1201 that make it risky for people to use the decryption keys in ways that industry dislikes; and "commercial licensing" is the permission from a DRM developer to interoperate with that DRM, including "compliance" rules (about the functionality of the technology product) and "robustness" rules (about tamper-resistance), that result in the licensee being issued decryption keys. In my view (I worked on EFF's objection) this is a deliberate attack on software interoperability: the whole point is to allow someone to try to prevent interoperability with software that hasn't been "approved". And it's also in extreme tension with the idea of having browsers that end-users can modify (their individual instances of).
- PeterisP 13y agoI see no way how an open source system can implement any effective DRM standard while staying open source. If a proper open source system has a component that enforces DRM, and is functional when I download it, then it includes those keys; but gives me an unconditional right to use and modify it. And I am physically able to modify it, un-implementing those restrictions. If part of the system cannot be modified by me, then the whole is not open source, and any open source system such as Firefox shouldn't include that part or standard.
- drdaeman 13y ago> If part of the system cannot be modified by me, then the whole is not open source "Open Source" definition does not include any clauses that require hardware manufacturers to provide you encryption and/or signing keys, so you could run your code. GPLv3 and "Free Software" are what you're looking for.
- epsylon 13y agoThe thing is most Firefox users don't even know what an extension is. If my parents' Firefox ships with support for DRMs, they won't care about it. Once it becomes widespread, there's simply no way to start "un-supporting it".