Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

http://defectivebydesign.org/blog/tim_bernerslee_approves_web_drm_w3c_member_organizations_have_two_weeks_appeal

by acabal • 9 years ago

249 215 9 years ago

deepnet• 9 years ago

“Under the spreading chestnut tree I sold you and you sold me"

Orwell, 1984 - A very sad day, a very poor decision:

"Today, the W3C announced that it would publish its DRM standard with no protections and no compromises at all, stating that W3C Director Tim Berners-Lee had concluded that the objections raised "had already been addressed" or that they were "overruled."

"EFF understood that the W3C had members who wanted to make DRM, so we suggested a compromise: a covenant, modeled on the existing W3C member-agreement, that would require members to make a binding promise only to use the law to attack people who infringed copyright, and to leave people alone if they bypassed DRM for legal reasons, like making W3C-standardized video more accessible for people with disabilities.

This was a very popular idea. It was endorsed by Unesco, by the Internet Archive, by the creator of the W3C's existing membership agreement, by hundreds of top security researchers, by the competition expert who coined the term "Net Neutrality", and by hundreds of human rights organizations and activists from the global south. The Open Source Initiative amended its definition of "open standard" so that DRM standards could only qualify as a "open" if they protected legitimate activity.

Now, it's fair to say that the W3C's DRM advocates didn't like the idea. After a perfunctory discussion process (during which some progress was made), they walked away from the negotiations, and the W3C decided to allow the standardization work to continue despite their unwillingness to compromise."[1]

https://www.eff.org/deeplinks/2017/07/amid-unprecedented-con...

fixermark3• 9 years ago

Ultimately, the actual standard of the web is the behavior implemented by major browser vendors.

Assuming the W3C committee voted down the EME standard, at this late point in the game and with no competing standard to satisfy the use case, what stops Google, Mozilla, Apple, and Microsoft from just implementing the standard as-drafted without the W3C's sign-off?

At that point, the browsers will be enabling functionality that browsers that don't implement EME support can't enable, media channels can take advantage of EME-supported encryption modules, users will see less functionality in other browsers and therefore have soft incentive to migrate away from other browsers, and it becomes incumbent upon the W3C to either release documentation describing already-existing browser functionality (as they've so often had to do) or be ever-so-slightly inaccurate as an authoritative source for describing web standards.

asadotzler• 9 years ago

Nothing stops them, and in fact each of the major browsers have already implemented EME.

kibwen• 9 years ago

Chrome has been using EME with Netflix since early 2013. This fight was lost years ago.

mitchty• 9 years ago

I can't wait until this gets used by malware!

fixermark3• 9 years ago

That was my first thought when I saw the spec for WebGL.

"Oh boy! I'm super excited to be running arbitrary code I downloaded from web sites against an API that was never security-hardened!"

Fortunately for me, my fears turned out to be overblown in that specific instance; there were a few security bugs, but they were patched with relative swiftness.

eridius• 9 years ago

I believe this specific fear is why Safari waited so long before enabling it for everyone (for a long time you had to manually turn it on in the Develop menu).

wmf• 9 years ago

Can you explain how malware could benefit from EME? Note that EME only applies to video.

fixermark3• 9 years ago

The reasoning goes that EME is a standard that specifically allows for attaching a closed-source black-box to the browser in a standardized way. This code is not auditable by outside sources, and therefore could be a breeding ground for malware and exploits (standard open-source philosophy that "sunlight is the best disinfectant"---many eyes on open source software minimizes the opportunities for exploitable bugs to hide). We've seen codec software---even open-source codec implementations---used as an attack vector in the past.

This reasoning, IMHO, ignores the fact that the user-agent still asks for consent, so the user may choose not to allow anything they can't audit. It's just the "Do you want to allow Flash to play this cool video?" story all over again.

mirimir2• 9 years ago

Yes, that'll be tasty.

BlackFly• 9 years ago

If false DRM initiatives are what it takes to get browsers to implement proper crypto modules, then sign me up.

Obviously it can't be used for DRM, I will just capture the frame and redirect it to a codec to re-encode the stream. Alternately, I can just stream it somewhere else.

On the other hand a secure place to store keys, free from the reach of plugins and javascript would be nice.

davexunit2• 9 years ago

This truly is the death of the open web. I hope the appeal is successful. Freedom seems to be losing on all fronts these days.

evv2• 9 years ago

Well this doesn't actually change much in practice. Web browsers have allowed black-box extensions for DRM'd content since the dawn of flash.

Personally I am disgusted that this standard is being promoted by the W3C and Tim Berners-Fucking-Lee. The browser vendors are perfectly capable of building (and even standardizing) this tech by themselves.

The open web is as available today as it ever was, and even more so with blockchain and "dark web" technologies like tor and i2p.

mirimir2• 9 years ago

Personally I am disgusted that this standard is being promoted by the W3C and Tim Berners-Fucking-Lee.

Yes, that's the disgusting part. But so it goes. The flesh is weak.

Overlay darknets are indeed the only hope for freedom.

Analemma_• 9 years ago

Personally I am disgusted that this standard is being promoted by the W3C and Tim Berners-Fucking-Lee. The browser vendors are perfectly capable of building (and even standardizing) this tech by themselves.

I don't understand these two sentences in conjunction, which is most of why I don't understand all the complaining about this issue. If, as almost everyone admits, the browser vendors are going to ship DRM-enabled playback one way or the other, what difference does it make whether it's in the official spec?

The HTML5 spec is just a piece of paper that exists to make web developers' lives easier. I don't understand the need to assign attributes like "purity" to it, especially when (as you yourself said), whether or not the DRM is in the spec changes nothing on the ground.

tveita2• 9 years ago

This truly is the death of the open web

About as much as music DRM was the death of music players. And as we all know the only way to play a music file today is to buy them in the Microsoft Zune store and squirt them over to your FairPlaysForSure(tm) certified KindlePod.

It's not a good thing; it lets some very big actors hurt themselves and their paying customers by still pretending that people will eventually come around to paying more for inferior service if only they force feed enough "you wouldn't download a car" ads to their dwindling customer base, and it encumbers the browsers to support yet another legacy standard that will be used only by exploit writers in ten years time.

But in the end this is never going to prevent you or anyone born after the sixties from accessing any significant piece of content. It is only going to stop you from going out of your way to pay for it.

I guess if YouTube started putting DRM on everything, that would reach the level of 'annoying'. Is there any indication they would do that?

zdkl2• 9 years ago

Is there any indication they would do that?

There won't be. Unless we actually make things happen to assure against "suddenly DRM", at some point the technology will be there that you cannot trivially bypass.

izacus6• 9 years ago

Right now DRM is the death of you being able to preserve the TV shows you love (they'll just disappear from Netflix after some time and you're not allowed to download them even if you paid for them), the death of being able to watch things on planes and the death of being able to watch things if one of your increasingly unreliable ISPs drops a connection.

II2II• 9 years ago

Everything that I have read suggests that this is standardizing what has already happened with video, which is a great deal better than the bad old days when companies relied upon Macromedia/Adobe for video streaming. (Or worse, a plug-in from an obscure company with an unknown track record).

As much as I would like to avoid DRM, relatively few producers are going to budge on the issue. The only options are standardized DRM, non-standardized extensions to provide DRM, or simply doing without. None of the options are particularly desirable. This one is likely the best of the three.

__jal• 9 years ago

I disagree. "Doing without" seems the most sensible to me.

There is no rule that industries whose business is built on copyright need to be able to live in the browser. Netflix demonstrated that quite nicely. Just because the want it doesn't mean they should get it. I personally cripple EME on my browsers, and if your content won't display for me, I'll happily go elsewhere. (Haven't had the problem yet, but fully expect to.)

It is bad enough, but unsurprising, that the closed browsers would go along with user-hostile bullshit like this. That Mozilla did, I find appalling.

javajosh• 9 years ago

Well, "doing without" is certainly the principled stand. But there is a lot of (almost certain, moderate) pleasure hiding behind one of door #1 (EME) or door #2 (torrent), and it is difficult indeed to go through door #3, (not this pleasure).

metajack9• 9 years ago

For doing without to work, all browsers must agree to do without. As soon as one browser ships it and people prefer browsers that can stream Netflix, everyone else must follow suit or wallow in obscurity.

Microsoft and Google make CDMs; no one else had a chance in this fight.

4bpp• 9 years ago

The standard argument against this says that while every bug, security breach and inconvenience that arises due to the alternative (non-standardised, proprietary DRM, or no in-browser DRM at all) may individually make engineers thinking about the system from an engineering standpoint break out in hives, the discomfort will also be felt by end users and associated with DRM, therefore serving as an obstacle to its public acceptance and proliferation.

As a relevant comparison, I think the current situation with the plethora of proprietary video game DRM solutions that are universally recognised to be terrible is strictly preferable to an alternative world in which video game DRM Just Works™, possibly with hardware support: in no small part thanks to it, we have a healthy amount of pressure on game studios to hold back and a market for DRM-free publishers such as GOG, and perhaps more controversially a healthy piracy ecosystem to punish the worst actors in the market.

zdkl2• 9 years ago

Exactly, not all tough problems have to be solved. In this case we probably should optimise for choice rather than an elegant system!

cyphar6• 9 years ago

This one is likely the best of the three.

I don't agree. Ignoring the massive injustice of ramming proprietary extensions into an open standard, standardising DRM has several secondary detriments to the free culture movement. In fact, standardising EME might actually be the worst of the three choices (the best being no DRM of course). Non-standard extensions are better to the movement (though still disastrous) than standardised ones, and here's why.

The most serious one is that it will appear to be far more convenient. One of the man ways that we could appeal to users who didn't particularly care about their software freedom being trampled on by corporations is that the method they used to trample on their freedoms were inelegant. Your monitor would flicker (and software would break) when it went to HDCP mode, Netflix might break every once in a while, Flash websites always were incredibly buggy. Meanwhile, VLC and family always just worked. Now, EME will make this experience "more seamless" which is a huge downside because now users won't even be aware of how many of their freedoms are being taken away.

The second is that now DRM is more appealing than it might've been 5 years ago. DRM isn't some horrible Flash applet that nobody understands the inner workings of, and when it breaks then you just have to deal with it. It's a standardised system around which more cabals will form. It's not something that just the AAC conspiracy operates around, it's far more accessible. If you thought that Blu-Ray was insane, you've seen nothing yet.

Every Flash vulnerability was a reminder that the status quo was not acceptable. Sure, the reminder came about for the wrong reasons (it turns out the pawns behind a conspiracy aren't generally very good at conspiring), but it came nonetheless. Now that EME will presumably be secure enough, all of these secondary issues that acted as entry-points for people to learn about how badly they are being mistreated will no longer be accessible. "Who needs a copy of their data when you can just stream it with a proprietary player that probably tracks you?"

metajack9• 9 years ago

It's a bit tough to argue we should keep computers insecure and hope people get annoyed and change their minds. Keeping people's computers safe is a primary goal of browser vendors, and this improves that state of affairs. Sure, DRM sucks, but at least the vendors can't root your machine and install keyloggers now.

tveita2• 9 years ago

relatively few producers are going to budge on the issue

They would budge if they had to - what are they going to do, stop selling their only product to paying customers out of spite? But of course it doesn't cost them anything to bluff, and they are used to get their way far beyond what their importance merits.

acabal• 9 years ago

But the web is the one in the position of power here. Media wants badly to be on the web--it's not the web that badly wants media.

Imagine if, back in the 90s, bigcorp still-image licensors like Getty or Bridgeman were able to magically foresee how big the internet was going to be. They campaign hard to include a DRM standard into the 90s web, so that nobody could right click and "save as" images from the web. After all, their bread-and-butter is licensing images. They succeed, and now it's the 90s, the web is in its infancy, and nobody can share or save images.

How would have the web evolved differently, if that was the case? I think most of us would agree that this would have put a terrible stranglehold on the evolution of the web as a technology and the web as a cultural force.

We're in a similar position today. Video is fairly new to the web, and bigcorp see how important a deal the web is. Instead of us making a stand and demanding the same freedom we got with images (freedom we largely received because of a combination of ignorance and benign neglect), we've caved and allowed videos to be locked away. Now we'll never see how the web could have evolved if anyone could have right click "saved as" a video.

metajack9• 9 years ago

I feel like that case was true back when this fight actually mattered. These days people use native-ish apps on iPads and smart TVs and not just laptops. So I think there is less market power on the web's side than there used to be.

Google and Microsoft both sell the CDMs (content decryption modules, ie, the actual DRM components used in EME), and it was certainly a benefit they touted for consumers before Firefox had an implementation as well.

Now anyone who wants to make a web browser must pay to play, and the people you pay are your competitors. Even if you could write your own CDM and get it ceritifed/trusted or whatever, you'd still have to convince every DRM-using video provider to also use it in addition to the others, which is going to be a very tough sell. And of course, it may be that no one wants to license a CDM to you to start with, and now part of the web is closed off to your users.

icebraining9• 9 years ago

There's no "web" vs "bigcorp". There's only bigcorp vs a motley bunch of weirdos like us, Mozilla, FSF and so. And they control 80%+ of the browser share.

d8421l01vv4r• 9 years ago

I, for one, am perfectly happy not giving money to companies enforcing DRM. If only 1/10 to 1/5 of the population cared (which will never happen), I'm sure we would see a major change in attitude from media companies.

bcheung• 9 years ago

What's the reason DRM can't be implemented as an open-source solution? Is the closed source just to prevent people from easily accessing the secret key or are there other reasons it needs to be closed source?

benchaney• 9 years ago

DRM is fundamentally security by obscurity. Being closed source is the only way to maintain obscurity, and thus the illusion of security.

problems3• 9 years ago

Yeah, this may change (in a somewhat scary way) with the Intel TXT and SGX extensions as then you'd only be relying on the obscurity of the hardware rather than the software.

ngneer4• 9 years ago

I disagree. Technologically it is possible to build a content protection system without obscurity, using open source software and open source hardware (and suitable cryptographic bootstrapping). That no one chooses to do so is another matter.

hsivonen3• 9 years ago

A DRM solution could be implemented with disclosed source code (though it would be more difficult than with concealed source code) but the key thing a DRM implementation does is to attest that the user hasn't modified the implementation--i.e. that the user hasn't exercised the freedoms provided by Open Source.

cyphar6• 9 years ago

Not to be a pedant (who am I kidding), but this is actually one of the examples where distinguishing between "free software" and "open source" is more than a philosophical disagreement.

You actually can create an open source DRM solution, because none of the OSI definition[1] makes reference to user freedom or other issues that DRM violates. As far as the OSI is concerned, DRM is can be released under an OSI license. Of course, you have to consider that according to the Digital Millenium Copyright Act, breaking DRM is _very_ illegal (regardless of whether or not the DRM'd media is still under copyright -- which means that DRM has no expiry).

However, if you subscribe to the free software definition[2], then you run into a problem. DRM in principle violates freedom #0: the freedom to run the program for any purpose. Now, there exist free software licenses that don't protect you against this threat (I believe only the GPLv3 actually addresses this issue), but note that just because a piece of software is under a free software license doesn't make it free software (there are whole classes of programs that might be GPLv3 but are still not considered by the FSF to be truly free -- DRM falls under that example).

[1] https://opensource.org/osd [2]: https://www.gnu.org/philosophy/free-sw.html

Another reason is that I guarantee their EME implementations are going to be full of bugs and making the source available would just make it easier to find them. This is the same AAC conspiracy that gave us the Sony rootkit after all[3] (which then went on to be used by other viruses).

[3] https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...

metajack9• 9 years ago

CDMs are sandboxed, which is an improvement over the NPAPI plugins. I don't think we have to worry much about Sony rootkit attacks at least.

TheAceOfHearts• 9 years ago

EME is useless garbage. It's one of the first things I disable when I install Firefox. I can't do much, but I boycott any service that uses it.

eveningcoffee• 9 years ago

I think all people who think that this will end with media only are naive. Next step is DOM.

problems3• 9 years ago

Let's encrypt the DOM in our open source browser... wait what?

EME is pretty great for cracking too - they enable rendering with the browser's own video engine, giving you a nice "hook to dump pre-decoded frame here" point.

the84725• 9 years ago

Not necessarily, the CDM can offload the rendering to protected hardware pipelines instead of the browser's usual video rendering.

https://www.w3.org/TR/2016/CR-encrypted-media-20160705/#medi...

metajack9• 9 years ago

Thankfully you can't obscure the DOM, but people certainly obscure JS and CSS plenty already. Mostly in the name of shrinking its size, but not always just that.

Try to learn how a Google web app works by inspecting the source code sometime.

emilfihlman• 9 years ago

I don't understand the point of WebDRM.

You can't simultaneously give us the content and not give us the content.

WebDRM is broken by default and pushing it is just absolutely retarded.

jandrese2• 9 years ago

As dumb and broken as it is, the state of the world is such that you can't deliver most video without something like it.

So the options are:

1. Stick to your guns and keep it out of the standard, free browsers will be unable to play Netflix, Hulu, HBOGo, BBC, etc... Propriety plugins that only work on one browser and/or one platform will exist and be annoying and buggy.

2. Give in and allow this braindamage in the standard because it means most browsers will be able to support video streaming from most sites.

3. Convince the MPAA and all of their members and all of the worldwide organizations like it that DRM is bad and that they should stop demanding it.

In the realm of what the W3C can accomplish, #2 seems like the least worst solution.

bad_user3• 9 years ago

Option 1 is the best because playing DRM content should be Netflix's problem.

Why in the world would you want to subsidize Netflix's development?

So what if Netflix's DRM plugin would be proprietary and buggy? Heck, that's a window of opportunity for DRM-free competition.

By making it a standard it means that we'll never, ever get rid of it. Even if DRM is fundamentally flawed.

#2 is in fact the worst solution.

metajack9• 9 years ago

Free browsers can't play Netflix anyway, because EME is just a standardized interface to a proprietary CDM, which one must license from a vendor (Microsoft of Google mostly).

What giving in achieved is a reasonable security story around the CDM module as opposed to the free for all of NPAPI plugins. It still totally sucks, but at least hte capabilities of these CDMs are quite limited.

frivoal3• 9 years ago

The best answer I know to this was written by Hixie (main editor of the HTML spec) a few years back:

https://plus.google.com/+IanHickson/posts/iPmatxBYuj2

kelnos7• 9 years ago

You can't simultaneously give us the content and not give us the content.

You actually mostly can, today, and "mostly" is good enough for the content producers.

If you have a DRM pipeline that has software and hardware that validates that it hasn't been tampered with (which is absolutely possible with today's technology), then the best an "attacker" can do is point a camera at the display device (and live with the reduced quality that brings), at least not without spending a ton of money on expensive hardware to defeat this.

And as another poster pointed out, DRM isn't really about protecting content from piracy, it's more about content producers having leverage over the people who make content-consumption technology. And it's working quite well for them for that purpose.

idibidiart• 9 years ago

The Web in Chains. The symbolism behind the "inventor" of the web signing on this is sending the wrong message to the young ones (the new generation) that idealism must give way to pragmatism and money interests.

Terrible, IMO.

AndyMcConachie2• 9 years ago

I have given money to the FSF for years and will continue to do so as a member. However, I do not support them in this fight. Berners-Lee is doing the right thing here.

aerovistae• 9 years ago

Can you elaborate on that? Why do you believe this?

AndyMcConachie2• 9 years ago

The choice we're faced with is either we get some standardized DRM in browsers or we get unstandardized DRM in browsers. That's the choice.

I've had email discussions with people at the EFF about this and we basically just had to agree to disagree. Their interpretation of the choice we're making is that we either get DRM in browsers or we get some magical fairy-tale land where DRM suddenly ceases to exist. I don't buy it.

Plus, as a Netflix subscriber I don't really mind DRM that much. Feel free to ask away, I'm always willing to talk about this.

pornel• 9 years ago

W3C takes advantage of the ambiguity of what the EME spec and "standard" DRM is. People unfamiliar with the spec may think it's the end of plug-ins and a spec for a DRM that is somehow open, implementable and cross-browser.

It's nothing like it. It's a small JS API that launches the same old, fully closed, proprietary DRM solutions. The NPAPI has been replaced with DMCA-protected interface, and previously separate DRM plug-ins are now called "modules" and shipped with the browser.

It's as if Chrome, which ships with Flash bundled-in, created a "HTML Multimedia Extensions" spec with just `navigator.launch("com.adobe.flash")` for launching "Multimedia Modules" (details of which are out of scope of the spec), and hailed it as the end of the non-standard Flash and plug-ins.

izacus6• 9 years ago

Note that part of standard DRM schemes is also "Computer verification" - e.g. that they refuse to work if your PC doesn't have the correct kernel, drivers or software installed. If you need special drivers to fix compatibility, want to customize your Android or do anything but leave your system full untouched and bloated, might be that you'll be prevented from watching online videos.

jopsen2• 9 years ago

To some extend perhaps...

One of the key arguments when Mozilla decided to implement EME was that the crappy-proprietary-code could be sandboxed by firefox to ensure that it doesn't infect a system with malware, spy on users, etc.

From a security perspective it's light years better than flash and other crappy plugins.

metajack9• 9 years ago

Before DRM plugins could access anything. Now they live in a sandbox which was not possible when they were NPAPI plugins. So the security story is actually much better as far as I know.

It still sucks to infect the web with this nonsense, but at least it can't do as much evil crap.

kevin_b_er2• 9 years ago

Now the DRM plugin can only access the DRM subsystem installed on your machine that has root enough access to verify your files, OS version, and graphics drivers, as well as a callchain allowing them to make draw calls to your GPU driver.

om23• 9 years ago

I think that is a bit of an exaggeration. First, for some browsers, the DRM scheme is built in, not any kind of plugin architecture.

Second, without EME, the state of the art for DRM video was to run the whole playback path through a plugin. Now, only the DRM bit is generally going to be hidden in binary blob (whether plugin or not.)

This has some important advantages:

* Web content authors can build video players using the same technology stack (HTML5 video+JS) for DRM-ful video as for DRM-free video. No need to learn a whole different plugin environment for this case.

* Video playback only has one code path, instead of totally separate browser and plugin video pipelines. Video codecs are complex, so this means less security attack surface.

* The browser's built-in playback is generally much more power-efficient, meaning more video viewing time on battery for your Netflix/Amazon/Hulu/etc video content.

* Even if the DRM scheme is some form of plugin, it needs far fewer capabilities than a plugin that has full video playback, live streaming, a scripting environment, etc. So it's less of a security risk

* Flash and Silverlight especially were common sources of critical security vulnerabilities and they'll be out of the picture.

* With approaches like MPEG Common Encryption[1], a single encrypted media resource can be used with multiple DRM schemes. This helps content hosts save on storage, and it makes it materially easier for new browsers to enter the market, since they don't have to ask content providers to host a whole separate copy of the video.

The continuing existence of DRM is admittedly not ideal. But supporting it in the browser instead of solely in the separate world of plugins has major user and developer benefits, as described above.

[1] https://en.wikipedia.org/wiki/MPEG_Common_Encryption

chii7• 9 years ago

same technology stack (HTML5 video+JS) for DRM-ful video as for DRM-free video

this isn't a pro in my books - i want DRM to be a difficult and cumbersome stack to use. More specifically, i want the end user to go through hassle to obtain the proprietary plugins, so that the end user feels the hurt from DRM. This makes a non-DRM version much more simple to view (just click and play), so that users would vote with their wallet, and use the non-DRM version (and avoid the DRM version).

If making DRM video easy to play for end users is the goal, then yes, web-DRM is doing it. But it will make DRM more prevailent, as end users will have no reason to try avoid DRM, thus, making web less open.

Buge• 9 years ago

Video playback only has one code path, instead of totally separate browser and plugin video pipelines. Video codecs are complex, so this means less security attack surface.

Nope. For any effective DRM (aka what all browsers use) the video codec decoding happens inside the DRM module. Otherwise anyone could just patch the open source browser and grab the decrypted compressed content coming out of the module. In reality, they can only grab the decrypted decompressed content.

sametmax• 9 years ago

Plus having a single blob responsible for, and only for, the DRM part means that hackers will have an easier time crack that, instead of a whole player. So we should get workarounds quite quickly.

makomk• 9 years ago

If you read the EME spec, unless they've changed you're not guaranteed to be able to overlay anything over the EME-provided video rectangle using HTML. The only cross-platform approach is to treat it as an opaque, untouchable area that does not interact with the HTML side of things in any way, like the bad old early days of plugins. Also, at least on Android the playback chain goes through TrustZone code that's effectively running at a higher privilege level than the kernel.

seltzered_2• 9 years ago

A younger version of myself would be against Web DRM, but these days I wonder if there's a potential for it to help in democratizing distribution among indie content producers. Ideally I'd have some time to piece together an essay, but the major points are:

1) Ted Nelson's vision on how Project Xanadu would have some form of copyright protection / micropayments for authors.

2) Independent content creators that have called it quits. There's tons of examples, but here's one that highlights issues: http://www.tonycomstock.com/2011/09/12/why-i-dont-make-movie...

I guess I see a vision where webDRM is an improvement over the walls of 'Apps' where content may not be DRM-free, but at least be linkable/URL-addressable.

(Disclaimer: I'm writing this without actually reading into the WebDRM spec, so feel free to criticize)

mmagin• 9 years ago

Has DRM ever actually stopped piracy?

seltzered_2• 9 years ago

No, but maybe we need to look at it from relative numbers.

Example: DRM music hasn't stopped music piracy, but better models for the content distribution (i.e. DRM music platforms like spotify, etc.) have demotivated more people from bothering to pirate music.

Fej• 9 years ago

The one example I have ever seen is Denuvo DRM for PC games, in certain games for (very) limited times.

Denuvo has gained widespread adoption among AAA game publishers because it tends to hold for the critical period when a game first goes on sale. The DRM is typically broken within weeks but that is good enough for the publisher, as the release period has generally passed by that point. They made their sales.

coldtea4• 9 years ago

Sure. Try pirating Reason or Cubase for one...

quickben• 9 years ago

As far as I know/talked to Indies/helped some, no.

#1 on most of their lists is getting the music/name out. DRM is counterproductive.

kobeya• 9 years ago

How much of this is a result of the predatory music industry where musicians typically never see anything from album sales anyway?

bubblethink5• 9 years ago

democratizing distribution among indie content producers

So I have this idea for a video/audio streaming website that operates like an open market. Website operator makes a cut for infrastructure costs. Other than that, the site runs pretty much on its own. No content deals, no drm, no geo restrictions, no ads. Some safeguards to limit abuse. A producer puts up content. Consumers consume content. Revenues are split between producers using some fair and transparent proportionality metric. Would there be any appetite for such a model ?

phit_• 9 years ago

so Patreon plus content hosting?

techer• 9 years ago

https://www.collide.com

Not sure if it fulfills everything and I like your model better.

etatoby• 9 years ago

no drm no ads revenues

Does not compute.

samsonradu3• 9 years ago

Can EME prevent people from doing 30fps screengrabs of their screen and dump all into an mp4 file using FFmpeg or such?

As someone else pointed here:

You can't simultaneously give us the content and not give us the content.

the84725• 9 years ago

The server can send an encrypted blob to your browser which hands it off to the DRM module which can hand it off to the system's ring -2 PAVP/Trustzone/etc. stuff that only runs signed firmware which passes it encrypted over the PCIe bus to the gfx hardware which passes it encrypted via HDCP2 to the monitor.

So in principle fully encrypted paths that can'e be screengrabbed exist. Not all DRM makes use of those components because it excludes users which don't hardware which supports it. But it is there.

samsonradu3• 9 years ago

Thanks for the detailed description.

.. which passes it encrypted via HDCP2 to the monitor.

And where does the decryption actually takes place?

EDIT

https://en.wikipedia.org/wiki/High-bandwidth_Digital_Content...

In order to make a device that plays HDCP-enabled work, the manufacturer must obtain a license from Intel subsidiary Digital Content Protection LLC, pay an annual fee, and submit to various conditions.[5][6][7] For example, the device cannot be designed to copy; it must "frustrate attempts to defeat the content protection requirements";[7] it must not transmit high definition protected video to non-HDCP receivers; and DVD-Audio works can be played only at CD-audio quality[7] by non-HDCP digital audio outputs (analog audio outputs have no quality limits).

This sounds quite far-fetched though. I'm quite sure we're going to see people literally recording their TV screen with a hand-camera soon.

How about the case where the hardware doesn't support it. Would screen-grabbing be possible then? Where will the decryption take place in that case?

bubblethink5• 9 years ago

So in principle fully encrypted paths that can'e be screengrabbed exist

This is the worrying part. While DRM has always existed, it has always been possible to defeat it largely because any software can be reverse engineered. Once you get down to the processor, it's close to impossible. And it's not like we have a lot of processor companies.

userbinator• 9 years ago

You can screengrab at the interface between the decoder in the monitor and the panel itself, using an LVDS capture card. Not cheap at the moment, and you still have to process the gigabits per second of uncompressed video, but you can expect the Chinese to come up with some inventive and low-cost solutions if they start locking down the other routes... in fact a lot of DRM-stripping hardware already exists for sale, if you know where and what to look for.

soapdog• 9 years ago

What many people that are on the periphery of this discussion sometimes fail to realize is that DRM is already here and already employed by many companies. The current DRM solutions are basically roll-your-own and each company has their own custom stuff which may or may not be vulnerable to attacks and steal/fingerprint the user thus affecting their privacy. This is the current state of things.

The EME/DRM spec is a bit different in which we still have DRM and it still sucks, but this DRM is now running on a sandbox environment and is standardized which makes it much easier to audit and a lot safer to use in terms of privacy for the user.

Of course "no DRM" is a better solution than "any DRM", but that is a pointless debate because content distributors are already onboard with DRM and there is no turning them back. The W3C spec is a compromise, a solution that enables those wanting to use DRM to be able to do so while we maintain some method of sandbox, privacy and safety. Running a module in EME/DRM is probably much safer than doing the same thing now with custom browser plugins.

As for the discussion of "browser X should not implement it, traitors!!!! Hate you forever!!! Will switch to $MORE_PROPRIETARY_ALTERNATIVE" is also a shortsighted argument in my opinion. If a browser doesn't implement EME/DRM spec, they shut their users out from being able to use many websites that employ DRM and what will happen is that that browser will loose users. If every single browser said "no to DRM" except for a single one, you'd see everyone installing that browser just to be able to play Netflix.

No browser can afford to loose millions of users by not implementing the spec. Those users matters. In terms of browser vendor political weight in spec discussions, user count matters. The DRM battle is a lost one because the content producers/distributors already decided to use it.

Now, if you're against DRM, instead of complaining about W3C spec'ing it out and browser vendors implementing it. You should stop using DRM content. No one is stopping anyone from preferring non-DRM solutions. For example, I don't like light beer, the existence of light beer sounds wrong for me, so I don't drink it but I don't try to stop others from drinking said watery yellow-ish drink. It is the same thing with DRM, instead of focusing your actions on W3C and browser vendors, focus your effort in content producers/distributors, prefer other solutions, make them ponder if it is worth loosing you.

syshum5• 9 years ago

>but this DRM is now running on a sandbox environment

I see this said many times, and it is highly over rated. while Technically speaking yes it calls for a "sandbox" but the need for "Computer Verification" means the CDM has to have full access to the entire system to verify the evil user is not attempting to capture the output. So the sandbox is not really protecting much unless the operating system itself has the CDM integrated as is the case for Windows. So on windows the CDM might be in a functional sandbox but on linux or any other non-proprietary system it is unlikely the sandbox will protect the user from a bad CDM, and given windows track record for security I would not put much faith in their sandbox either.

On the security front I do not believe it has changed much, this idea that the CDM will be more secure seems to be more PR Marketing than actual fact. Further given the refusal of companies to sign onto a Non-Aggression Pledge to protect researchers from DMCA liability it is likely any security issues in the CDM's will go unreported for fear of legal repercussions.

>>Now, if you're against DRM, instead of complaining about W3C spec'ing it out and browser vendors implementing it. You should stop using DRM content.

Why can a person not do both? Why does a person that has ethical problems with DRM, and view the actual existence of DRM is a threat to their personal liberty be silenced or told to STFU as you have here?

Bad ideas, like DRM, should be continually criticized until they are dead. Vocal opposition as well as monetary boycotts are both valid and should be used to oppose bad ideas like DRM

One of the reason people are opposing video DRM so strongly at the w3c level is we fear it will not stop with Video. Images, Ebooks, Fonts even the web pages themselves are all a target for DRM Supporters. There will come a time that the F12 tools will be useless because the entire page itself is being served via a locked down CDM style plugin. This is just the first phase of killing the Open Web in its entirety

icebraining9• 9 years ago

Regarding the sandbox, that's not correct on all browsers:

[I]n Firefox the sandbox prohibits the CDM from fingerprinting the user’s device. Instead, the CDM asks the sandbox to supply a per-device unique identifier. This sandbox-generated unique identifier allows the CDM to bind content to a single device as the content industry insists on, but it does so without revealing additional information about the user or the user’s device. In addition, we vary this unique identifier per site (each site is presented a different device identifier) to make it more difficult to track users across sites with this identifier.

https://hacks.mozilla.org/2014/05/reconciling-mozillas-missi...

Steeeve3• 9 years ago

DRM is a non-starter and is in reality defective by design.

Pirates have created markets where there were none and are an important part of every entertainment eco-system. It's been that way since the beginning.

This is just another in a long string of bad decisions that attempts to give major distribution channels far more control than they deserve or could ever manage responsibly.

If you want to make money in entertainment, the business plan is simple. 1. Get people to like you. 2. Find a way for those people to get you money. You don't need Google, Netflix, Apple, NBC, CBS, ABC, RKO, ClearChannel, or anybody else that inserts themselves between you and your customers. None of them provides enough real value to anybody who didn't already have a market before leveraging them.

The fact that this standard is coming to be is just plain silly, but it does no harm in and of itself. All of the potential problems are today's reality. A rubber stamp by W3C implementing a tag in the HTML spec and blessing a workflow change nothing.

The FSF is stirring up noise without providing links to what it's talking about. I presume it's this: https://www.w3.org/TR/encrypted-media/

The workflow isn't particularly well thought out - it's not significantly different than what RealMedia or Adobe have had put together for a generation.

The real downside is the fact that browsers will be further plagued with vague integrations. Those integrations will all carry security ramifications that nobody cares to consider until a major exploit is publicized. The fact that so many people are willing to sacrifice their security for access to a 12 year old lionsgate video is beyond me, but such is the nature of the world we live in. Like I said before though... that is a problem that browsers face today. The new "standard" doesn't change much in reality.

CharlesW• 9 years ago

DRM is a non-starter… […] The fact that this standard is coming to be is just plain silly, but it does no harm in and of itself.

If that's true, for you and for others who share that opinion, what does it matter?

None of them provides enough real value to anybody who didn't already have a market before leveraging them.

It's hard to take a position like "digital distributors offer no value" seriously when the paid digital media marketplace was created by said distributors.

Steeeve3• 9 years ago

If that's true, for you and for others who share that opinion, what does it matter?

I don't have a dog in the race. For me, it doesn't. The world would be a better place without DRM and it would be a better place without TSA, but I can do nothing about either.

It's hard to take a position like "digital distributors offer no value" seriously when the paid digital media marketplace was created by said distributors.

The market was created by Napster and it's cousins. The ability to hand over money was a matter of getting the music labels and movie studios on board - and half of them are still reluctant participants at this point. Anybody can give them money. None of them provides exclusive access to a customer base, and none of them provide a significant boost to sales for products without their own separate marketing.

There's a "Netflix for..." so many different markets because all you need to do is sign a contract with the studios for access to media which they'll deliver directly to customers themselves.

During the time when Tower Records or Target actually provided access to customers that nobody else could provide, the distribution channels were valuable. Now what they accomplish is a simple and easily repeatable commodity.

kodablah• 9 years ago

The fact that this standard is coming to be is just plain silly, but it does no harm in and of itself.

I disagree that it does no harm. I agree with this quote from the article:

"If EME is ratified by the W3C, the FSF expects it to cause a long-term increase in the amount of DRM on the Web, by simplifying the DRM implementation process for streaming services."

Standardization is explicit support and encouragement.

Steeeve3• 9 years ago

Forgive me for having a differing opinion, but just to clarify.

I would agree with the FSF statement that there will be more DRM on the web.

Where I differ is that I believe it would happen regardless. If it's not standard DRM, then it's Apple DRM and Windows DRM... like we already have.

Standardization is explicit support and encouragement.

Standardization shouldn't be about good or bad. If enough people want to do something, there should be a standard.

Having said all of that, please don't get me wrong. I'm just clarifying how I feel. I do tend to have unpopular opinions. I don't have a dog in the race and I would be perfectly OK with DRM in general being rejected by the W3C because it is a terrible concept that ends up being paid for by consumers.

MikeTaylor• 9 years ago

If the W3C does this, it will be time -- regrettably -- to turn away from that organisation and make a completely new one that exists to serve users of the Web rather than those seeking to monetise it. That Tim Berners-Lee has lent his name to this hijacking is shameful.

gue5t• 9 years ago

How are we to deal with the problem that the browser developers are also on the side of monetization?

objclxt• 9 years ago

How do you propose that your new utopian organization actually get its standards implemented by user agents?

The only time there has been a half successful splintering off of the W3C was WHATWG, and WHATWG only worked because it was backed by the browser vendors themselves.

mark_l_watson• 9 years ago

I have only had one long conversation with TBL, but he appears at least to me to have his heart in the right place. I met him at the Decentralized Web Conference June 2016.

I want two things, at least, from the web:

1. An open platform where I can post content on my own web site, link to other people's web sites, and let them link to my sites.

2. I like to buy access to entertainment: Google Play Music and Movies, Netflix, Hulu, and HBO Now.

Ideally I should be able to have both of theses modes of using the web, and people who don't want DRM should be able to disable DRM and rent Bluray movies, check movies out of their local libraries, etc. There are some producers, like Spiritual Circle Cinema and others, who sell DRM free video.

I would like to see everyone get everything they want from the web.

jancsika• 9 years ago

Anyone know if the EFF plans to throw some of their weight behind this particular appeal?

frivoal3• 9 years ago

I believe they want to, but the appeals process is an untested one, and will be evaluated by the same people who made the original decision. Don't get your hopes too high.

mehh• 9 years ago

Yeah thats fine, freedom of choice and a better experience for users, sounds pragmatic to me.

Much better than the many posts here trying to force their opinion on the world!

shmerl• 9 years ago

That's a shame. He should know better than to approve this unethical garbage.

Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

Related Stories