5 ms·

DRM/EME in HTML5 - an American thing

51 points by Tsiolkovsky 13y ago

jlebrech 13y ago
I don't understand why they are pushing drm when they could implement a webbytecode (ie. the v8 ast as a loadable blob) and just do the drm on their own dime.
- pyalot2 13y ago
  Because running it this way, Google, Microsoft and Apple can't exclude browser competition. With EME they can.
  - azakai 13y ago
    AFAIK, Apple is not participating in EME - has that changed?
    - pyalot2 13y ago
      Apple is, and has been participating in EME. Apple employees are active on the W3C EME-WG ML and they are regularly scheduled to attendance of Telephoneconferences by Microsoft, to which they appear and comment. Microsoft has become the main lobbying party in pushing EME forward, with google mostly taking a passive role. There is no standard that W3C or WhatWG develop that was pursued as aggressively by Microsoft as EME. The last time similar levels of "standards activism" by Microsoft are documented is when they corrupted an international standardization process to push the Open XML document standard trough. I would be very worried if the EFF, Cory Doctorow, RMS, FSF, CCC, defective by design, WhatWG and a long list of other organizations agree against a standard, but Microsoft, Apple, Google and Netflix are closely cooperating to make it happen.
      - gsnedders 13y ago
        The (eventual) AC vote on progression is a simple majority vote — where there is one vote per AC representative (and one AC rep per Member). (The vote technically only happens if an appeal is launched with 5% of the AC in support, which requires one or more Formal Objections — but will almost certainly happen in this case.) The EFF is the only person/org in that list of people who are Members. The rest — effectively — have no say. The Director practically cannot go against the majority of the AC (as they can just amend the Process to remove the Director's veto). You'll need to convince a lot more Members to vote against it. I see no evidence of MS having done anything underhand here — this is simply a case of a lot (quite possibly a majority) of Members wanting something a lot of people disagree with.
      - azakai 13y ago
        Thanks for the info! Are there any public links I could read more about this on? (specifically Apple's involvement and commitment)
- jmillikin 13y ago
  1. The only way to have even somewhat secure Digital Restrictions Management is to have some proprietary binary on the local machine which can authenticate itself to the display device. This requires a level of access permission which you do not want to provide to the web in general. 2. If the DRM blob were delivered via the web, then it would be trivially easy to connect through a proxy that delivered its own ineffective DRM blob. Content companies would not accept this solution. 3. The goal of EME is not to increase the number of people who can access restricted content, it's to provide a replacement for the rapidly collapsing Flash Player pseudo-standard. The various content companies require their distributors to use something at least as good as Flash, but YouTube et al know that Flash probably won't exist in a few years, so the race is on to see which replacement will dominate the market. --- The basic position of EME opponents appears to be that if we refuse to allow DRM modules in browsers, then the companies pushing DRM will give up and let us watch unrestricted video. This position, in my opinion, is fantastically optimistic. If EME is blocked, then these companies will either start distributing their own customized locked-down applications ("You must install the Netflix Player to watch this movie"), or will work privately with the major proprietary browser platforms (IE, Safari, Android Chrome, ChromeOS) to implement what they demand. Firefox and Chrom{e,ium} will be left out in the cold, and the advancement of the open web will se a significant setback.
  - shmerl 13y ago
    How will the open Web advance if EME is added to the standard? Using HTML with DRM modules in a "standard" way doesn't make the Web any more open, than when that DRM is outside outside the browser altogether. I.e. while content companies are crazy bent on DRM, let them use their custom applications all they want. What's the problem with that? In time they might gain sanity and drop this useless junk. But their mind sickness is not a reason to pollute the standard with it as well.
    - jmillikin 13y ago
      HTML+DRM is closer to an open web than a locally installed proprietary application + DRM.
RyanZAG 13y ago
I find the funniest part of all of this DRM browser talk is that the people most in favor of this kind of standardized DRM are pirates. It's fairly easy to see why when you look at the obvious point that any DRM running client side can be cracked. By standardizing it into the browser, you only need to crack a single thing - the browser DRM module - and then you will have free and unrestricted access to all of the DRM content with no additional work. It's the same way PS2 piracy was so rampant. You only needed to install a simple mod chip into your PS2, and since all of the DRM relied on that, you could now run every game with no additional work. It created something of a golden age for gaming piracy and the PS2 actually remains popular today in certain regions because of it. So standardizing DRM into the browser is a huge boon for pirates, and a problem waiting to happen for everyone else. The stupidity is sometimes mind-blowing.
- icebraining 13y ago
  The proposed standard is just an interface to be implemented by the browsers. The actual decryption happens in a non-standard, proprietary binary module.
  - azakai 13y ago
    Yes, and there will be multiple of those, not just 1. Right now, Google and Microsoft each have their own (Widevine and PlayReady, respectively).
- watty 13y ago
  Not sure why you think this but the people most in favor of this kind of DRM are certainly not pirates. Also, I don't understand your PS2 comparison - how exactly did the DRM on PS2 enable piracy? It was a poor implementation of DRM that was bypassed. If they had no DRM it would have been even easier.
  - PeterisP 13y ago
    Otherwise most of game manufacturers would try to implement a different, custom solution (as for PC games) which would need to be cracked separately for each game, instead of a one-crack-fits-all permanent solution.
oscargrouch 13y ago
Wow! That make us wonder how Sweden(and Germany?) are advanced and sophisticated in technological policies over the rest of us; They got people from the pirate-party elected to the congress already? look at the all the issues they are discussing, and the high-level of the discussions.. Meanwhile, our governments or are in bed with the corporations or are unprepared to deal with their lobby in a way that dont hurt people, innovation, fair competition and democracy.. She has an X ray vision to this complicated issue and make someone who understand all the danger that come from this evil game of monopoly, feel more safe to have a good and prepared parliament to defend the interests of the people the way she is doing.. I think that is an example of what our democracies need to breath a new, revigorating air, and get stronger again with the faith and trust of the people
- icebraining 13y ago
  She's a member of the European Parliament, not the Swedish. That said, as far as I know we tend to have more heterogenous members in our parliaments, here in Europe.
- rmc 13y ago
  Meanwhile, our governments or are in bed with the corporations or are unprepared to deal with their lobby in a way that dont hurt people, innovation, fair competition and democracy.. If you think politics in Europe (at the local, national and european level) doesn't have political corruption, I've got a bridge I can sell you.
  - oscargrouch 13y ago
    ha! ok.. That's definitely spread all over the world, unfortunately we are not free from the spooks yet.. but what i meant is that they are a step further.. and think that countries with stronger industries and big lobby groups will have a hard time to elect and create real politics that can benefit the interests of the population in the digital rights ground.. So its not that they are not suffering from the same diseases of the democracies all over the world.. its the observation that by electing this class of representatives, prepared for the XXI century and the digital age, they are more prepared against those evil and corrosive effects on governments imposed by a industry formed in the XX century and with a hard time to adapt to new times
asadotzler 13y ago
I find it amusing that everyone is acting like there's no DRM today and this is somehow an attempt at bringing DRM to the Open Web. DRM is already a required and de facto standard for the Open Web -- it's just hiding inside of NPAPI and ActiveX. It's there and it's even worse than DRM because there are no DRM plug-ins that don't bring massive runtimes with them that are the number one cause of security problems on the Web. (If you do not have Flash or Silverlight today, you are not going to be able to watch restricted content. Pretty much everyone has one or both installed and will happily install it if it's not already on their system.) Killing NPAPI and ActiveX, which is how DRM integrates with browsers today, and replacing it with a much smaller and considerably safer API is progress at shrinking the proprietary surface of today's real Web. This is two steps forward and one step back, folks. This is positive evolution.
- shmerl 13y ago
  > DRM is already a required and de facto standard for the Open Web How is it required? Browser makers have to implement it to adhere to standards? Site makers have to use it to adhere to standards? No, nothing like that. DRM is an optional junk now. Making it a standard promotes it to mandatory status. Also, the statement that DRM is a "standard for the open Web" is an oxymoron. It's like saying that spreading disease (not vaccines) is a standard for curing. DRM is a complete antithesis of openness. So, to correct what you said, it should read: DRM is already a required and de facto standard for the closed Web. And those who really care about the open Web should oppose DRM everywhere. DRM should be marginalized, through plugins and 3rd party non trusted black boxes which are hard to use and which are very apparently a problem. Not integrated with comfort through EME and the like, which only masks the problem, but doesn't solve it. To give a clear analogy - hidden surveillance camera is not better because it's hidden, it's actually worse because people don't think about it. "Unobtrusive", "comfortable" and etc. DRM is not better - it's always much worse.
- azakai 13y ago
  Decreasing the API surface is a good goal, that's a fair point. However, in practice, the API surface will remain the same: IE will not remove ActiveX, Firefox (and a few other smaller browsers) will still have NPAPI, and Chrome has PPAPI. So this allows one use case to move to a smaller API, but that's pretty much it. A large API surface for proprietary blobs will remain. Worse, things like iOS, Windows Phone, etc. have browsers that don't run plugins at all, but Apple and Microsoft may well add EME support there, which means an increase in their API surface that reaches proprietary blobs.
chris_wot 13y ago
She makes a good point. Netflix doesn't work at all in Australia. This is very much an American thing.

51 points by Tsiolkovsky 13y ago

I don't understand why they are pushing drm when they could implement a webbytecode (ie. the v8 ast as a loadable blob) and just do the drm on their own dime.

pyalot2 13y ago
Because running it this way, Google, Microsoft and Apple can't exclude browser competition. With EME they can.
- azakai 13y ago
  AFAIK, Apple is not participating in EME - has that changed?
  - pyalot2 13y ago
    Apple is, and has been participating in EME. Apple employees are active on the W3C EME-WG ML and they are regularly scheduled to attendance of Telephoneconferences by Microsoft, to which they appear and comment. Microsoft has become the main lobbying party in pushing EME forward, with google mostly taking a passive role. There is no standard that W3C or WhatWG develop that was pursued as aggressively by Microsoft as EME. The last time similar levels of "standards activism" by Microsoft are documented is when they corrupted an international standardization process to push the Open XML document standard trough. I would be very worried if the EFF, Cory Doctorow, RMS, FSF, CCC, defective by design, WhatWG and a long list of other organizations agree against a standard, but Microsoft, Apple, Google and Netflix are closely cooperating to make it happen.
    - gsnedders 13y ago
      The (eventual) AC vote on progression is a simple majority vote — where there is one vote per AC representative (and one AC rep per Member). (The vote technically only happens if an appeal is launched with 5% of the AC in support, which requires one or more Formal Objections — but will almost certainly happen in this case.) The EFF is the only person/org in that list of people who are Members. The rest — effectively — have no say. The Director practically cannot go against the majority of the AC (as they can just amend the Process to remove the Director's veto). You'll need to convince a lot more Members to vote against it. I see no evidence of MS having done anything underhand here — this is simply a case of a lot (quite possibly a majority) of Members wanting something a lot of people disagree with.
    - azakai 13y ago
      Thanks for the info! Are there any public links I could read more about this on? (specifically Apple's involvement and commitment)
jmillikin 13y ago
1. The only way to have even somewhat secure Digital Restrictions Management is to have some proprietary binary on the local machine which can authenticate itself to the display device. This requires a level of access permission which you do not want to provide to the web in general. 2. If the DRM blob were delivered via the web, then it would be trivially easy to connect through a proxy that delivered its own ineffective DRM blob. Content companies would not accept this solution. 3. The goal of EME is not to increase the number of people who can access restricted content, it's to provide a replacement for the rapidly collapsing Flash Player pseudo-standard. The various content companies require their distributors to use something at least as good as Flash, but YouTube et al know that Flash probably won't exist in a few years, so the race is on to see which replacement will dominate the market. --- The basic position of EME opponents appears to be that if we refuse to allow DRM modules in browsers, then the companies pushing DRM will give up and let us watch unrestricted video. This position, in my opinion, is fantastically optimistic. If EME is blocked, then these companies will either start distributing their own customized locked-down applications ("You must install the Netflix Player to watch this movie"), or will work privately with the major proprietary browser platforms (IE, Safari, Android Chrome, ChromeOS) to implement what they demand. Firefox and Chrom{e,ium} will be left out in the cold, and the advancement of the open web will se a significant setback.
- shmerl 13y ago
  How will the open Web advance if EME is added to the standard? Using HTML with DRM modules in a "standard" way doesn't make the Web any more open, than when that DRM is outside outside the browser altogether. I.e. while content companies are crazy bent on DRM, let them use their custom applications all they want. What's the problem with that? In time they might gain sanity and drop this useless junk. But their mind sickness is not a reason to pollute the standard with it as well.
  - jmillikin 13y ago
    HTML+DRM is closer to an open web than a locally installed proprietary application + DRM.

RyanZAG 13y ago

I find the funniest part of all of this DRM browser talk is that the people most in favor of this kind of standardized DRM are pirates. It's fairly easy to see why when you look at the obvious point that any DRM running client side can be cracked. By standardizing it into the browser, you only need to crack a single thing - the browser DRM module - and then you will have free and unrestricted access to all of the DRM content with no additional work. It's the same way PS2 piracy was so rampant. You only needed to install a simple mod chip into your PS2, and since all of the DRM relied on that, you could now run every game with no additional work. It created something of a golden age for gaming piracy and the PS2 actually remains popular today in certain regions because of it. So standardizing DRM into the browser is a huge boon for pirates, and a problem waiting to happen for everyone else. The stupidity is sometimes mind-blowing.

icebraining 13y ago
The proposed standard is just an interface to be implemented by the browsers. The actual decryption happens in a non-standard, proprietary binary module.
- azakai 13y ago
  Yes, and there will be multiple of those, not just 1. Right now, Google and Microsoft each have their own (Widevine and PlayReady, respectively).
watty 13y ago
Not sure why you think this but the people most in favor of this kind of DRM are certainly not pirates. Also, I don't understand your PS2 comparison - how exactly did the DRM on PS2 enable piracy? It was a poor implementation of DRM that was bypassed. If they had no DRM it would have been even easier.
- PeterisP 13y ago
  Otherwise most of game manufacturers would try to implement a different, custom solution (as for PC games) which would need to be cracked separately for each game, instead of a one-crack-fits-all permanent solution.

oscargrouch 13y ago

Wow! That make us wonder how Sweden(and Germany?) are advanced and sophisticated in technological policies over the rest of us; They got people from the pirate-party elected to the congress already? look at the all the issues they are discussing, and the high-level of the discussions.. Meanwhile, our governments or are in bed with the corporations or are unprepared to deal with their lobby in a way that dont hurt people, innovation, fair competition and democracy.. She has an X ray vision to this complicated issue and make someone who understand all the danger that come from this evil game of monopoly, feel more safe to have a good and prepared parliament to defend the interests of the people the way she is doing.. I think that is an example of what our democracies need to breath a new, revigorating air, and get stronger again with the faith and trust of the people

icebraining 13y ago
She's a member of the European Parliament, not the Swedish. That said, as far as I know we tend to have more heterogenous members in our parliaments, here in Europe.
rmc 13y ago
Meanwhile, our governments or are in bed with the corporations or are unprepared to deal with their lobby in a way that dont hurt people, innovation, fair competition and democracy.. If you think politics in Europe (at the local, national and european level) doesn't have political corruption, I've got a bridge I can sell you.
- oscargrouch 13y ago
  ha! ok.. That's definitely spread all over the world, unfortunately we are not free from the spooks yet.. but what i meant is that they are a step further.. and think that countries with stronger industries and big lobby groups will have a hard time to elect and create real politics that can benefit the interests of the population in the digital rights ground.. So its not that they are not suffering from the same diseases of the democracies all over the world.. its the observation that by electing this class of representatives, prepared for the XXI century and the digital age, they are more prepared against those evil and corrosive effects on governments imposed by a industry formed in the XX century and with a hard time to adapt to new times

asadotzler 13y ago

I find it amusing that everyone is acting like there's no DRM today and this is somehow an attempt at bringing DRM to the Open Web. DRM is already a required and de facto standard for the Open Web -- it's just hiding inside of NPAPI and ActiveX. It's there and it's even worse than DRM because there are no DRM plug-ins that don't bring massive runtimes with them that are the number one cause of security problems on the Web. (If you do not have Flash or Silverlight today, you are not going to be able to watch restricted content. Pretty much everyone has one or both installed and will happily install it if it's not already on their system.) Killing NPAPI and ActiveX, which is how DRM integrates with browsers today, and replacing it with a much smaller and considerably safer API is progress at shrinking the proprietary surface of today's real Web. This is two steps forward and one step back, folks. This is positive evolution.

shmerl 13y ago
> DRM is already a required and de facto standard for the Open Web How is it required? Browser makers have to implement it to adhere to standards? Site makers have to use it to adhere to standards? No, nothing like that. DRM is an optional junk now. Making it a standard promotes it to mandatory status. Also, the statement that DRM is a "standard for the open Web" is an oxymoron. It's like saying that spreading disease (not vaccines) is a standard for curing. DRM is a complete antithesis of openness. So, to correct what you said, it should read: DRM is already a required and de facto standard for the closed Web. And those who really care about the open Web should oppose DRM everywhere. DRM should be marginalized, through plugins and 3rd party non trusted black boxes which are hard to use and which are very apparently a problem. Not integrated with comfort through EME and the like, which only masks the problem, but doesn't solve it. To give a clear analogy - hidden surveillance camera is not better because it's hidden, it's actually worse because people don't think about it. "Unobtrusive", "comfortable" and etc. DRM is not better - it's always much worse.
azakai 13y ago
Decreasing the API surface is a good goal, that's a fair point. However, in practice, the API surface will remain the same: IE will not remove ActiveX, Firefox (and a few other smaller browsers) will still have NPAPI, and Chrome has PPAPI. So this allows one use case to move to a smaller API, but that's pretty much it. A large API surface for proprietary blobs will remain. Worse, things like iOS, Windows Phone, etc. have browsers that don't run plugins at all, but Apple and Microsoft may well add EME support there, which means an increase in their API surface that reaches proprietary blobs.

chris_wot 13y ago

She makes a good point. Netflix doesn't work at all in Australia. This is very much an American thing.