4 ms·

You're right about DRM implementations in general, but note that the W3C standard isn't actually a DRM implementation, it's (afaict) a common API that allows we

by jomohke 13y ago

You're right about DRM implementations in general, but note that the W3C standard isn't actually a DRM implementation, it's (afaict) a common API that allows web pages to supply their own DRM implementations. An open source browser can conform to the W3C DRM standard ("Encrypted Media Extensions") and remain open source.

chris_wot 13y ago
Except they need to implement Content Decryption Modules, which are not standardised and which may use features (or DRM systems) that are only implemented on particular systems. Ultimately, this extension could tie particular content to a particular system. Say, for instance, you could only watch some content on a Windows 8 system because it requires a Microsoft specific DRM system implemented only on Windows 8. A system that could ultimately be badly documented (or not documented at all) that makes it hard for competing browsers to use the CDM. Frankly, this system would only work if you standardise in a DRM system. The W3C may claim "only the simple clear key system is required to be implemented as a common baseline" [1], but that's highly misleading IMO. 1. https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-media/encrypted-media-fpwd.html https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-med...
- acdha 13y ago
  The idea is that currently most video on the web plays in either Flash or Silverlight, which are poorly supported plugins which offer a huge amount of extra functionality and – more importantly – attack surface. This is really only about replacing a huge proprietary blob with a much smaller one.
  - shadowmint 13y ago
    What are you talking about? The video element already exists and is implemented in all major browsers. Have a good look over http://en.wikipedia.org/wiki/HTML5_video http://en.wikipedia.org/wiki/HTML5_video This has exactly nothing to do with reducing the attack surface of a browser. What this is about is letting people like Audible and Netflix encrypt their content in a special way that means that only browsers that support the DRM api can decrypt it; by including the closed source binary blobs provided by those vendors. Don't want to do that? Sorry, our website doesn't work on your browser. ...but to the main point: This will in fact catastrophically increase the attack surface of browsers, as they are forced to bundle unmoderated, unreviewed binary code blocks (Content Decryption Module, from the spec) that can do whatever they like into the browser code.
    - kevinpet 13y ago
      What fantasy world are you living in that non-DRM HTML 5 video is the status quo for paid content?
      - pessimizer 13y ago
        What fantasy world are you living in where he/she said that non-DRM HTML 5 video was the status quo for paid content? What was said was that it is there, and services are choosing not to use it, even accepting that using it would be suicide for their business. It's not the responsibility of http to preserve the business models of those companies rather than a free and open internet, though it's understandable that those businesses are fighting for it.
    - acdha 13y ago
      I don't have Flash or Silverlight installed on my system. Trust me when I say that approximately zero commercial video is available with these plugins. Even half of the ad-supported content on YouTube isn't available. As an implementor, until mozilla finished shipping native h.264 support I have to either use Flash as a fallback for IE8 and Firefox (mediaobject.js is great!) or encode all of my video twice and double my storage bill. Guess which one is more appealing?
    - takluyver 13y ago
      AFAIK, there is nothing in the current proposal about forcing browsers to bundle CDMs. The CDMs could be part of the OS, installed separately, or simply not there at all (in which case you have a browser that won't play DRM video, but is otherwise fully functional). That's no different from the current situation with Flash and Silverlight. You're not forced to use them, but some content is only accessible if you do. If we can replace Flash with a CDM, the attack surface is decreased, because a CDM is less complex. Without the EME standard, it seems highly unlikely that media companies would decide to distribute videos DRM-free. They would simply continue to build and use non-standard solutions. EME is just a standard API for what they'd be bound to do anyway.
      - 13y ago
fafner 13y ago
No, it won't allow websites to provide their own DRM implementation! The proposal only provides an interface to the HTMLMediaElement to be used by the website to talk to a restrictions module inside the browser. It does not specify how the restrictions module is implemented. It also does not define a common API to load such a module in a browser. In fact the module can also be built into the browser. Which is exactly what Microsoft will be doing with their PlayReady for the Internet Explorer. An open source browser would have to rely on the DRM module to do all the video decoding and rendering. If the module handles the unencrypted stream back to the browser then one could simply change the browser to dump the stream. A browser would also have to make sure that other JavaScript can't access the unencrypted content. So no more funny graphic effects with videos rendered onto canvas or WebGL textures. This proposal will destroy the open web and make it rely on closed source binary blobs. A free software browser will end up being useless because it will be excluded from most of the content. Who would want to use Firefox or Chromium if they can't access YouTube? When we start to add DRM for media elements then how long can it be until publishers demand DRM for text and image content? And what argumentative position would the W3C have to refuse it? With Firefox market share decreasing and proprietary browsers like Chrome, IE, Safari increasing we are in a really bad position. Microsoft can simply push their PlayReady in IE and provide plugins for Chrome and Safari. Netflix is already using PlayReady. So no change for them. And then Firefox is fucked. Linux is fucked. And how long until Google moves YouTube to DRM? Google is involved in the design of the DRM proposal. If DRM is in HTML5 then it's just a simple step for them. That's why we have to oppose DRM in HTML5 and keep the web open. It is sad that Tim Berners-Lee has given up on the open web. But I won't and I hope Mozilla won't and I hope you and others won't either.
- azakai 13y ago
  > That's why we have to oppose DRM in HTML5 and keep the web open. It is sad that Tim Berners-Lee has given up on the open web. But I won't and I hope Mozilla won't and I hope you and others won't either. Fully agree. I think the focus of the effort should be to lobby the 2 browser vendors that are driving this DRM effort, Google and Microsoft (see 'Editors' section on https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-media/encrypted-media.html https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-med... ). The only way to stop this DRM proposal is to have it not be implemented in browsers. The only way to stop that is to convince Google and Microsoft to stop pushing it.

by jomohke 13y ago

chris_wot 13y ago

Except they need to implement Content Decryption Modules, which are not standardised and which may use features (or DRM systems) that are only implemented on particular systems. Ultimately, this extension could tie particular content to a particular system. Say, for instance, you could only watch some content on a Windows 8 system because it requires a Microsoft specific DRM system implemented only on Windows 8. A system that could ultimately be badly documented (or not documented at all) that makes it hard for competing browsers to use the CDM. Frankly, this system would only work if you standardise in a DRM system. The W3C may claim "only the simple clear key system is required to be implemented as a common baseline" [1], but that's highly misleading IMO. 1. https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-media/encrypted-media-fpwd.html https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-med...

acdha 13y ago
The idea is that currently most video on the web plays in either Flash or Silverlight, which are poorly supported plugins which offer a huge amount of extra functionality and – more importantly – attack surface. This is really only about replacing a huge proprietary blob with a much smaller one.
- shadowmint 13y ago
  What are you talking about? The video element already exists and is implemented in all major browsers. Have a good look over http://en.wikipedia.org/wiki/HTML5_video http://en.wikipedia.org/wiki/HTML5_video This has exactly nothing to do with reducing the attack surface of a browser. What this is about is letting people like Audible and Netflix encrypt their content in a special way that means that only browsers that support the DRM api can decrypt it; by including the closed source binary blobs provided by those vendors. Don't want to do that? Sorry, our website doesn't work on your browser. ...but to the main point: This will in fact catastrophically increase the attack surface of browsers, as they are forced to bundle unmoderated, unreviewed binary code blocks (Content Decryption Module, from the spec) that can do whatever they like into the browser code.
  - kevinpet 13y ago
    What fantasy world are you living in that non-DRM HTML 5 video is the status quo for paid content?
    - pessimizer 13y ago
      What fantasy world are you living in where he/she said that non-DRM HTML 5 video was the status quo for paid content? What was said was that it is there, and services are choosing not to use it, even accepting that using it would be suicide for their business. It's not the responsibility of http to preserve the business models of those companies rather than a free and open internet, though it's understandable that those businesses are fighting for it.
  - acdha 13y ago
    I don't have Flash or Silverlight installed on my system. Trust me when I say that approximately zero commercial video is available with these plugins. Even half of the ad-supported content on YouTube isn't available. As an implementor, until mozilla finished shipping native h.264 support I have to either use Flash as a fallback for IE8 and Firefox (mediaobject.js is great!) or encode all of my video twice and double my storage bill. Guess which one is more appealing?
  - takluyver 13y ago
    AFAIK, there is nothing in the current proposal about forcing browsers to bundle CDMs. The CDMs could be part of the OS, installed separately, or simply not there at all (in which case you have a browser that won't play DRM video, but is otherwise fully functional). That's no different from the current situation with Flash and Silverlight. You're not forced to use them, but some content is only accessible if you do. If we can replace Flash with a CDM, the attack surface is decreased, because a CDM is less complex. Without the EME standard, it seems highly unlikely that media companies would decide to distribute videos DRM-free. They would simply continue to build and use non-standard solutions. EME is just a standard API for what they'd be bound to do anyway.
    - 13y ago

fafner 13y ago

No, it won't allow websites to provide their own DRM implementation! The proposal only provides an interface to the HTMLMediaElement to be used by the website to talk to a restrictions module inside the browser. It does not specify how the restrictions module is implemented. It also does not define a common API to load such a module in a browser. In fact the module can also be built into the browser. Which is exactly what Microsoft will be doing with their PlayReady for the Internet Explorer. An open source browser would have to rely on the DRM module to do all the video decoding and rendering. If the module handles the unencrypted stream back to the browser then one could simply change the browser to dump the stream. A browser would also have to make sure that other JavaScript can't access the unencrypted content. So no more funny graphic effects with videos rendered onto canvas or WebGL textures. This proposal will destroy the open web and make it rely on closed source binary blobs. A free software browser will end up being useless because it will be excluded from most of the content. Who would want to use Firefox or Chromium if they can't access YouTube? When we start to add DRM for media elements then how long can it be until publishers demand DRM for text and image content? And what argumentative position would the W3C have to refuse it? With Firefox market share decreasing and proprietary browsers like Chrome, IE, Safari increasing we are in a really bad position. Microsoft can simply push their PlayReady in IE and provide plugins for Chrome and Safari. Netflix is already using PlayReady. So no change for them. And then Firefox is fucked. Linux is fucked. And how long until Google moves YouTube to DRM? Google is involved in the design of the DRM proposal. If DRM is in HTML5 then it's just a simple step for them. That's why we have to oppose DRM in HTML5 and keep the web open. It is sad that Tim Berners-Lee has given up on the open web. But I won't and I hope Mozilla won't and I hope you and others won't either.

azakai 13y ago
> That's why we have to oppose DRM in HTML5 and keep the web open. It is sad that Tim Berners-Lee has given up on the open web. But I won't and I hope Mozilla won't and I hope you and others won't either. Fully agree. I think the focus of the effort should be to lobby the 2 browser vendors that are driving this DRM effort, Google and Microsoft (see 'Editors' section on https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-media/encrypted-media.html https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-med... ). The only way to stop this DRM proposal is to have it not be implemented in browsers. The only way to stop that is to convince Google and Microsoft to stop pushing it.