Reconciling Mozilla’s Mission and the W3C EME

http://andreasgal.com/2014/05/14/eme/

by fabrice_d • 12 years ago

186 191 12 years ago

makomk5• 12 years ago

I'd be interested to see if any content providers actually make use of this; it seems to be missing certain technical requirements they claimed their partners required during the EME design phase. (In particular, a secure hardware video path and robust node-locking support. This design doesn't appear to actually be able to lock content playback to particular hardware at all if anyone makes even the most trivial attempt to bypass it.)

wmf5• 12 years ago

The history of SDMI vs. iTunes and AACS vs. Windows XP has taught me that DRM "requirements" are just the opening position in a negotiation. Apparently Mozilla doesn't have enough leverage to get rid of DRM completely but they have enough to water it down a bit.

makomk5• 12 years ago

Possibly, but they've already managed to get the W3C and several of the other big browser vendors to agree to meet those requirements, which gives them some pretty strong leverage.

cwyers2• 12 years ago

I understand Mozilla's philosophical objections to the EME, but if the alternative is Flash/Silverlight (and it's pretty clear that is, in fact, the alternative), I don't think Mozilla's mission loses out by implementing the EME.

makomk5• 12 years ago

In practice, so far the EME implementations that content providers have actually been willing to support have been far more tightly locked down than Flash or Silverlight. The Microsoft one supports hardware-level protected playback paths and unlike Silverlight no-one's managed to get it to run under Wine, and the Google one only runs on locked-down official Chromebook hardware which users can't run any non-Google programs on.

bsmedberg• 12 years ago

The major DRM platform out there is Netflix on Silverlight, and it's not particularly locked-down at all.

Of course there are others, but they hardly matter at all in terms of marketshare.

stormbrew2• 12 years ago

Flash works on the three major desktop/laptop OS', ChromeOS, all the consoles afaik, and Android. EME will probably result in balkanized DRM that will never work on a bunch of those things (or you'll have to worry about whether the content you want to watch supports your platform).

EME is a step down from Flash for consumer choice. A big fat one.

tedmielczarek• 12 years ago

Flash DRM has never worked on Linux, AFAIK.

mmagin• 12 years ago

The Flash browser plugin is NOT available on current versions of Android. There is some Flash available for Adobe AIR apps, but that's something different.

shmerl30• 12 years ago

No, alternatives are not using DRM at all.

cwyers2• 12 years ago

No, Flash absolutely exists and is almost as ubiquitous as web browsers themselves. You don't get to ignore it just because you don't like it.

rasz_pl• 12 years ago

Alternative is TPB

mindcrime3• 12 years ago

and in the near future this should allow us to retire plugins altogether.

I don't see this as a universally "Good Thing".

The Web has evolved to a comprehensive and performant technology platform and no longer depends on native code extensions through plugins.

You mean the Web has evolved into a Doctor Frankenstein's monster like hodge-podge of kluged together hacks, layered on top of layers of other hacks, layered on top of still more hacks, in order to make a Web Browser a poor man's operating system.

So if we can extend our operating systems by installing programs, why shouldn't we be able to extend our poor man's operating system by installing plugins?

I'm assuming this is referring to killing of NPAPI and not other "extensions" mechanisms, but it seems (from what I've heard here and there) that people are mostly proposing to replace NPAPI with "nothing" or with less powerful APIs that would limit plugins significantly.

gioele• 12 years ago

So if we can extend our operating systems by installing programs, why shouldn't we be able to extend our poor man's operating system by installing plugins?

IF we can extend our operating systems. Do not take that for granted, and not for too long.

JoshTriplett4• 12 years ago

Replacing unsandboxed plugin APIs like NPAPI that can directly access the OS with sandboxed plugin systems like NaCl and emscripten that support sandboxed native code seems like a major improvement. The browser is quite enough attack surface area; let's not expand it further by having plugins.

That said, while the article's described sandboxing approach to EME works better than the alternatives (assuming content providers will support it), that's a lot like saying "at least the arrow through your eye wasn't on fire". Gee, thanks.

AnthonyMouse3• 12 years ago

Replacing unsandboxed plugin APIs like NPAPI that can directly access the OS with sandboxed plugin systems like NaCl and emscripten that support sandboxed native code seems like a major improvement.

Until you want to write a plugin with a legitimate reason to directly access the OS.

mindcrime3• 12 years ago

Don't get me wrong, I'm not saying we should keep NPAPI around forever... and I acknowledge security as a legitimate concern. But power and extensibility are legit concerns as well, and I worry about an overly restrictive environment where the evolution of media on the web is forced into lockstep with the evolution of browsers, without even the option of going "off the reservation" and using something radically different.

Of course, at the end of the day, this is one HUGE advantage of OSS, and with many of the major browsers being OSS, someone could always fork a browser with whatever kind of plugin support they want if they really need it (and are able to support it).

smacktoward• 12 years ago

You mean the Web has evolved into a Doctor Frankenstein's monster like hodge-podge of kluged together hacks, layered on top of layers of other hacks, layered on top of still more hacks

So it's like every other successful platform in history, then.

mindcrime3• 12 years ago

You make a good point. :-)

Somehow it seems worse with the Web to me though, but maybe that's just because it's so ubiquitous and used for such a variety of things.

belorn• 12 years ago

Nothing prevents mozilla if they would want to add a warning box similar to self-signed certificates every time a website tries to access DRM code outside the users control.

It would serve the goal of objecting to the EME, while users can continue to access all content they want. It would also put the responsibility to the website if the black box called DRM causes problems, locks up, or cause havoc on the user. Third, it allows users who do not want DRM to hijack their machine to explicit express their approval before such code is executed.

cben3• 12 years ago

This is exactly the situation today with Flash. Click-to-play is akin to a warning. Users are somewhat aware Flash causes problems, locks up etc.

nawitus3• 12 years ago

preventing users from saving the content

How can an open source software prevent users from saving the content? If the CDM decrypts to plaintext, it should be trivial to modify the open source sandbox to save the plaintext data. (Obviously the software can prevent saving the content by default).

chimeracoder4• 12 years ago

According to Mozilla's official statement[0], it will not be open-source (it will be an open-source wrapper around the closed-source binary)

There is still the question of the analog hole[1], but that's a separate matter (unrelated to open source vs. proprietary binary blob).

[0] https://blog.mozilla.org/blog/2014/05/14/drm-and-the-challen...

[1] https://en.wikipedia.org/wiki/Analog_hole

ygjb3• 12 years ago

You got [0] wrong. It is an open source wrapper around a closed source CDM.

AnthonyMouse3• 12 years ago

Nobody really uses the analog hole. It's actually easier to do it digitally, and will remain so, because securing a device against arbitrarily many attackers with physical access and arbitrarily large amounts of time and resources is a practical impossibility. The analog hole is just the formal proof that DRM can never be effective, because if you can see it or hear it you can record it.

dublinben• 12 years ago

It's not even necessary to exploit the analog hole. You can get an HDMI splitter that will strip HDCP, and an HDMI capture card that will let you save full quality, digital video from any protected source.

nawitus3• 12 years ago

I interpreted the open-source wrapper to be something that receives the media to be displayed in the browser (but this is just a guess).

rlx0x2• 12 years ago

I guess thats pseudo DRM. On the other end you have things like RTMPe, a proprietary highly complex binary protocol that is only implemented in the adobe flash plugin binary blob. Or something like HDCP (the copy protection part of HDMI) that builds a hardware encryption platform, with an central authority and certified hardware vendors.

Those are just 2 examples of "strong" DRM, but since even those two have been so thoroughly broken, we can just assert that any DRM that is based on W3C EME is gonna be childsplay. I don't think anyone actually believes that this W3C crap is gonna be "secure".

makomk5• 12 years ago

The EME standard is explicitly designed to support hardware encryption systems that provide end-to-end encryption - think a proprietary decryption black box in your devices that takes an encrypted, compressed video screen and overlays it directly onto the screen output without it ever touching RAM anywhere where software can access it. Good luck breaking that, short of inconvenient hacks involving HDCP decryption and recompression (and those may not be long for this world either - newer video outputs are AES-encrypted).

JoshTriplett4• 12 years ago

Some Open Source PDF readers respect the "don't copy" and "don't print" bits, even though you can trivially disable them.

mdeslaur2• 12 years ago

DRM is more about having leverage over the provider of the playback device and casual piracy than it is about protecting the content against hardcore piracy.

zanny5• 12 years ago

Hardcore pirates don't watch this BS, they just get the entire season off Piratebay in 4k with surround sound.

mixedbit2• 12 years ago

Which in reality translates to: DRM is about screwing honest users, pirates always find a way around it.

uptown• 12 years ago

"...Firefox users are at risk of not being able to access DRM restricted content (e.g. Netflix, Amazon Video, Hulu), which can make up more than 30% of the downstream traffic in North America."

While this statement is factually accurate, using the file-size of a type of content as a measure of relevance should be of little relevance to the discussion.

lucb1e• 12 years ago

Why not make is a configuration option whether to enable the DRM in Firefox? People who only want to see non-DRM content (much like people running GNU/Linux with "libre" software only) can simply disable the DRM, and the users that are not actually tech savvy won't have to resort to, say, shudders MSIE.

chimeracoder4• 12 years ago

I'm wondering this as well - why can it not be implemented (from the browser perspective) as a plugin that is downloaded upon first use?

Isn't this what Iceweasel on Debian will have to do anyway, since Debian cannot ship non-free software in their main repositories?

mbrubeck• 12 years ago

Yes, it will be a plugin that is downloaded on first use. That's exactly what the blog post describes.

quadrangle• 12 years ago

I think that's what they are doing by requiring consent to add the sandboxed support for Adobe's DRM crap.

kwierso• 12 years ago

Isn't that what the following portion of the blog post is all about?

"As plugins today, the CDM itself will be distributed by Adobe and will not be included in Firefox. The browser will download the CDM from Adobe and activate it based on user consent."

wfjackson• 12 years ago

The writing was on the wall a while ago once Google implemented this into Chrome(Netflix on Chromebooks was the first real world use of this IIRC). Firefox no longer has the market power it once used to have thanks to Chrome being bundled and installed by default with Flash, Acrobat and Java updates etc. Google has been spending massively on pushing Chrome even bundled as default on new machines with OEM agreements to reduce payments to Mozilla in the long term and it's working since the past few years.

Pluginless HTML5 support for H.264 followed a similar path, in which Google promised to remove support from Chrome in favor of WebM(which FF and Opera added support for) but never did, in the meantime Firefox and Opera relied on the promise and then were forced to start implementing support once they realized Google was not going to keep the promise and it was hurting them and then included support(I don't think Opera ever did?).

Three of the four major browsers, Chrome, IE, Safari are owned by huge corporate interests and Mozilla is pretty much powerless since users blame FF if it doesn't support something, so I expect more of such things to happen in the future. It's pretty much game over at this point and I fear this is only the tip of the coming iceberg with all these companies having huge media deals for Play Store, XBox Music/Video and iTunes.

chimeracoder4• 12 years ago

Mozilla is pretty much powerless since users blame FF if it doesn't support something

Mozilla is pretty much powerless since users blame FF if it doesn't support something and the bulk of its funding comes from one of those corporate interests (Google).

(Both are problems - even if Mozilla had the market share, if it were still funded (almost) solely by Google, these things would still eventually happen, since the power tends to follow the money in the end.).

I really hope Mozilla manages to become financially independent of Google, whether through donations or some other revenue stream.

magicalist• 12 years ago

even if Mozilla had the market share, if it were still funded (almost) solely by Google, these things would still eventually happen, since the power tends to follow the money in the end.).

This isn't supported by reality. Feel free to offer any evidence at all, however.

You could just as easily postulate that every privacy enhancement that google adds to their search page is because of influence by Mozilla, which Google is massively dependent on for traffic and therefore revenue, since power tends to follow the money in the end.

Depending on your stat source, at least 1/5 of internet users use Firefox, which means that the percentage of Google users on Firefox is probably that percentage or higher. The Mozilla Corporation is wholly owned by the Mozilla Foundation, but Google has shareholders. So who is more important to whom?

gcp• 12 years ago

I really hope Mozilla manages to become financially independent of Google, whether through donations or some other revenue stream.

They announced Directory Tiles a while ago, which is a step in that direction.

gsnedders• 12 years ago

Opera still doesn't ship H.264 support, except on mobile and some embedded products (TVs, settop boxes, etc.).

atopal2• 12 years ago

In other words: except where they have any market share at all.

atopal2• 12 years ago

  > in the meantime Firefox and Opera relied on the promise
  > and then were forced to start implementing support once
  > they realized Google was not going to keep the promise
  > and it was hurting them and then included support(I don't
  > think Opera ever did?).

Not only that, Mozilla partnered with CISCO to make h264 usage free for all. Now, people can modify and redistribute Firefox and still retain the ability to play h264. Something that Google gave a shit about when they included h264 in Chrome, but not in Chromium.

If you are using Chrome, don't fool yourself, you are not using an open source browser, but you are helping Google further the agenda of its stakeholders, and they made it clear what their priorties are when they took the first step by implementing this on Chromebooks.

evilpie• 12 years ago

Actually what happened to that Cisco h264 project?

EdwardDiego3• 12 years ago

If you are using Chrome, don't fool yourself, you are not using an open source browser, but you are helping Google further the agenda of its stakeholders

As an example, Chrome won't ship an adblocker by default... but they will add code to prevent popunders from working.

Guess which ad format Google doesn't do...

JonoW• 12 years ago

A lot of people include Apple when talking about how the big companies are pushing EME, but Safari is now the only browser that hasn't announced support for it. I assume they'll eventually do it, but it's worth noting that Firefox wasn't the last browser to announce support.

EdwardDiego3• 12 years ago

. Firefox no longer has the market power it once used to have thanks to Chrome being bundled and installed by default with Flash, Acrobat and Java updates etc.

Firefox also went through a very long period of being a memory heavy browser with multiple tabs and the UI sharing a single thread of execution for JS execution - meaning that one badly behaving website could render the entire browser unresponsive.

...at least that's why I stopped using it.

EdwardDiego3• 12 years ago

I love the person who downvoted this without any response. Am I wrong about the technical challenges Firefox faced?

abcd_f• 12 years ago

It is naive to expect that decrypted media stream will ever be leaving CDM module as so optimistically shown on that illustration.

Microsoft dropped and neglected a bunch of great features when shipping Vista, but it went out of its way to drag Protected Media Path into it. PMP is fronting a major industry effort to create trusted software and hardware framework that on one end accepts encrypted stream and on other draws video pixels on the screen, all the while showing a middle finger instead of raw data to the user on whose system this whole circus unfolds.

It will be laughable to think that CDM won't be PMP-based. Getting access to the raw data with CDM in picture is a pipe dream. Mozilla, sandbox, open source - no matter. CDM exists to prevent raw data leaks.

http://en.wikipedia.org/wiki/Protected_Media_Path

wmf5• 12 years ago

It will be laughable to think that CDM won't be PMP-based.

Even on Linux and OS X?

ds9• 12 years ago

Edit: It's said to be a downloadable extra at user option.

The Moz page description of the sandbox says the CDM won't have any system access, so it could not distinguish whether PMP is there or not, except maybe by flags in the input from the browser. So either the Mozilla sandbox-CDM can't work as described or PMP won't be required.

Someone correct me if I've missed something there.

davb• 12 years ago

This concerns me. Amazon Prime Instant Video requires HDCP via Silverlight. Support for this is pretty much non-existent in Linux drivers, so watching Prime video via Pipelight is limited to standard definition (no HD).

I worry that with EME/CDM will come a requirement for HDCP on other services such as Netflix. Inconsistent HDCP implementation will be another thing to fight on the video driver compatibility front (and let's be honest, I don't give a crap about HDCP support - it's a flawed system that assumes every user is a pirate).

penguindev• 12 years ago

DRM inside Intel CPUs.

ivanca• 12 years ago

    <audio drm="true">
    <img drm="true">
    <article drm="true">

As soon as you let them put a foot on your house is absurd to believe that the rest will not follow.

davexunit2• 12 years ago

We have come to the point where Mozilla not implementing the W3C EME specification means that Firefox users have to switch to other browsers to watch content restricted by DRM.

Then so be it. If Mozilla's mission is to improve and defend the "open" web, then EME should never have been considered for implementation. They shouldn't sacrifice their goals for the sake of market share.

ygjb3• 12 years ago

Improving and defending the open web is not just about fighting the good fight on DRM. The Mozilla mission also calls for us to fight for users right to make choices[0] as well.

Mozilla could choose not to implement EME, and draw that line in the sand, but that means denying users the option of continuing to use Firefox to access content they choose to access.

My preference (both as a long time Firefox user, and a Mozillian) is to see Mozilla allow me to access content, and continue to support the Mozilla mission rather than switch to an alternate browser to access content[1].

[0] http://www.mozilla.org/en-US/about/manifesto/ [1] PS... you can argue that I shouldn't access encumbered content, but you are wasting your breath (or bits) ;)

davexunit2• 12 years ago

Sure, the user may want to access DRM-encumbered content, but we shouldn't promote such a thing. You're not denying the users anything by refusing to implement EME, the media companies are denying the users freedom by insisting on using malware to deliver content! Just because users want Netflix in Firefox doesn't mean that it's the right thing to provide.

Ygg23• 12 years ago

You think most users will care if it ships EME or no? Like seriously?! I'd love to live in that world.

Basically if Netflix doesn't work with Mozilla who's gonna be blamed? Netflix that works on Chrome? Google, whose browser plays Netflix or Mozilla that doesn't open Netflix? If you answered Mozilla, you live in real world :(

No, this one is squarely on shoulders of those that supported that damned crud of W3C standard.

If Mozilla doesn't back this up, it will be marginalized even more and only Google, Microsoft and Apple will decide on the future of open web. And we all know what that will mean for the open web.

phillc73• 12 years ago

Who gives a fuck about Netflix? What percentage of the Internet population are ever likely to or are even interested in subscribing to Netflix/Hulu/Amazon Prime etc?

What grates me most is that if Mozilla was really targeting the developing world, as per their aims with cheap FirefoxOS phones, then there would be no need to implement this, which simply panders to the needs of first/western world media companies demanding DRM on their content.

I'm exceedingly disappointed with Mozilla for making this decision.

joncrocks• 12 years ago

Think about winning the battle vs. winning the war.

Mozilla could draw a line here, and no further, and not implement EME. But the consequence might be that FF market share drop significantly, as "Mah netflicks don't werk."

Suddenly Mozilla lose a large amount of revenue, development is scaled back, and the relevance of FF is reduced. Eventually FF is marginalised and Mozilla no longer involved in discussions about the future of the web. I think everyone would be disappointed if that happened.

The issue here is that the W3C is trying to push a round peg into a square hole. Laws passed by governments are in opposition to reality, and the only way to solve the problem at hand is security by obscurity and 'trusted' devices.

While it's noble of Mozilla to resist change of this type, it's fighting an uphill battle against legal precedents and legislation that is trickling down into technology. I don't think it's a battle that winnable until changes are made to IP frameworks the world over.

angersock• 12 years ago

But the consequence might be that FF market share drop significantly, as "Mah netflicks don't werk."

Then maybe those users deserve the loss of their freedoms.

josteink3• 12 years ago

he consequence might be that FF market share drop significantly, as "Mah netflicks don't werk."

You mean like it already doesn't in most of the world, because of arbitrary geographical restrictions?

I can't see this causing noticeable damage.

josephlord• 12 years ago

So the open source wrapper can receive unencrypted audio/video frames. Does that mean it does the video decoding too or does it get the compressed stream back?

Either way it doesn't sound like a very strong protection of the content as you can access it with at most a single generation compression loss.

Is it me or are the content providers and the DRM providers realising the limits of DRM and loosening their requirements?

higherpurpose2• 12 years ago

No, it just means they were ignorant enough about the technology to allow Mozilla to do it this way - for now. Also, Mozilla gets to say now that "look, we're implementing DRM, but it's not so bad".

However, once the content owners see how useless this method is (they all are, but this in particular), they will demand heavily proprietary closed source down to the metal software to protect their content. And since Mozilla has "already" kind of agreed to do this, they'll have no choice but to implement that much worse version of DRM.

13throwaway• 12 years ago

Well then, how is Midori doing these days?

higherpurpose2• 12 years ago

So - what other good truly open source browser is out there?

Ygg23• 12 years ago

Firefox.

Chromium is a mess, Opera is Chromium, WebKit will support this no doubt.

bzbarsky2• 12 years ago

Given that Apple is one of the major DRM vendors, it's a pretty good bet that Safari will support EME. WebKit proper, it's unclear.

shmerl30• 12 years ago

Netflix is considered the main driver behind this DRM madness. In the context of Netflix, an often voiced reason for DRM is the fact that it rents movies, rather than sells them. Besides DRM being completely ineffective to prevent piracy, the concept of rentals itself doesn't make any sense for digital goods.

The core logic behind a rental (for physical goods) is reusability. Physical goods have a fixed cost of production per copy, so the price of selling it should cover that cost. Renting is expected to be cheaper than buying, because the object is returned to the renter which allows reusing it for new clients without expenses on another physical copy. I.e. most of the price in the rental case goes for the service of using it, and not for covering the cost of production.

With digital goods this whole premise doesn't apply. There is practically zero cost of producing another copy, so reusability is implicitly achieved with practically no expense by copying bits. And it also means there is no need to return the merchandise so it could be reused by others, since the merchant easily duplicates the merchandise practically for free. Therefore why would renting cost any different than buying? The whole concept of renting is illogical for digital goods. Therefore user can buy the digital merchandise for a (lower) price as paralleled by physical renting, while still retaining the ownership.

Netflix proponents claim, that they are charged per month to access anything, so in such context renting makes sense. But it still doesn't. They are charged for the service to stream the data. I.e. for convenience. It's cheap not because they need to return the merchandise so others could reuse it (as above). It's just cheap as is. There is completely no need to prevent users from retaining a copy once they watched it (i.e. which means buying). In order to it put in practical perspective, Netflix can be achieved without any DRM by selling each copy for some small price or / and charging a monthly fee for a convenience of streaming that data from the cloud while users could also keep those downloaded DRM-free copies all they want. I'd totally subscribe to such service. But I'd never subscribe to Netflix the way it is now because of DRM.

eridius4• 12 years ago

Claiming that rentals don't make sense in the digital age is focusing far too heavily on the technical fact of how digital data works, and completely ignoring the legality of things, including intellectual property.

If I make a movie and sell you a DVD, the terms of the sale prohibit you from, say, showing this movie in a theater to a bunch of strangers and charging them money. Yes, you own the physical DVD, but you don't own the intellectual property of the movie itself. This holds true for physical copies, and it holds true for digital distribution as well. You are purchasing the right to personal use of the movie (i.e. viewing), and that's it.

If you want to e.g. show it in a theater (whether or not you're charging admission), you have to purchase that right separately. And that costs a lot more.

In the case of rentals, the company that is doing the rentals pays for the privilege of renting out the movie, and the cost they pay is predicated on concurrent access to the movie being limited.

When it comes to digital rentals, limiting concurrent access to the digital movie file doesn't make sense. Users who rent things digitally expect there to be no wait. But in turn, they're only given access for a limited time. For iTunes, that's 30 days since you paid for the rental, and then only 24 hours since you started actually watching it. You can't rent a movie on iTunes and watch it every day for a month, because you don't have that legal right. You must pay for that privilege, which is to say, you must buy the digital movie.

For Netflix, the limited access to the movie is gated by you having an active Netflix subscription. The moment you stop paying for Netflix, you no longer have access to the movie. This again makes perfect sense, since you're paying Netflix for the right to access all of their streaming movies for the duration of your active membership. You are not paying for completely unrestricted access.

Unfortunately, due to the nature of digital content, the only way to actually enforce these legal restrictions is by use of DRM. It sucks, but it's a fact of life. This is true for rentals, and it's generally true for purchases as well.

shmerl30• 12 years ago

yes, you own the physical DVD, but you don't own the intellectual property of the movie itself. This holds true for physical copies, and it holds true for digital distribution as well.

This is really irrelevant. When you buy a book you also own the book, and not the intellectual property it contains. Same thing with files - you can own the file, but not the intellectual property it represents. So legally nothing is wrong with buying digital goods (files), while the intellectual property they hold is only licensed to you (and not sold). I don't see how it correlates with any necessity for DRM.

But in turn, they're only given access for a limited time

I don't see a need for it. Limited time of rental is justified for physical goods. For digital it's not (I explained above why).

his again makes perfect sense, since you're paying Netflix for the right to access all of their streaming movies for the duration of your active membership. You are not paying for completely unrestricted access.

I understand Netflix terms, what I question is their sensibility. You say it makes perfect sense. I don't see any sense in limiting access. Netflix can charge the same thing for unlimited access, plus allowing making backups and still make the profit (it can add a charge per file if they worry that users would just download the whole catalog at once).

Unfortunately, due to the nature of digital content, the only way to actually enforce these legal restrictions is by use of DRM.

No, DRM can't enforce it (since this stuff is pirated practically instantaneously). So why is it used?

nileshtrivedi2• 12 years ago

why would renting cost any different than buying?

So that you can segment the buyers into two: Those who want to see a movie only once and those who want to see it more than once. This way, you can double charge the second segment and use those funds to reduce the price for the first segment. Classic market segmentation.

As long as there are customers of both kind, rentals (even for digital goods) will make sense.

shmerl30• 12 years ago

No, it doesn't. My point is there is no need for such segmenting and overcharging those who want to see it more than once (except greed). Because there is no big difference in expenses for the distributor between these two use cases, except for the fact that the second can use the service more. But they already charge the monthly fee.

Anyway, it's not even the case here! Netflix has no plans for purchasing, so there is no segmenting there at all.

jaxytee• 12 years ago

There is completely no need to prevent users from retaining a copy once they watched it.

For Netflix there's one big reason to: PROFIT

shmerl30• 12 years ago

What profit? Netflix offers rentals only, and no sales. And Netflix DRM doesn't prevent any piracy since users who want to illegally retain the copy can do it either way. So what is the reason for them using it? They can simply use sales and have the same profit.

icebraining9• 12 years ago

Do you really think that studios would license content to Netflix without DRM?

The reason for Netflix to push DRM is simple: you can't offer a streaming service with just House of Cards and a handful of unknown shows.

shmerl30• 12 years ago

I understand the situation with studios having crazy demands. My question was equally addressed to their reasoning. And I don't agree in general that Netflix has no way to improve things. Distributors have more influence on publishers than single users.

I already wrote elsewhere about GOG. They work with gaming publishers and convince them that DRM is never needed. And it works. Not always, but with some of them. The more it works, the easier it is for them to demonstrate it to others. But one needs a will to put an effort into it. GOG have DRM-free as their core value. Could Netflix attempt a similar effort? They could. But they don't value DRM-free distribution, so they don't want to bother.

cben3• 12 years ago

Even more absurd is the story of ebook lending. IIUC libraries fought for it in the consumers' interest with the result that you can sometimes now "take out" an ebook from a library or another reader, blocking their access to it until you "return" it. Worse, publishers implemented "wearing out" of the copy after some number of uses! [http://www.digitaltrends.com/mobile/e-book-library-lending-b...]

I tried to go paper-less last year but gave in when I noticed most books I wanted I can get on Amazon for like: - $15 for a ebook (of limited use due to DRM) - $10 printed in advance on dead trees and shipped to me - $4 for a used paper copy (in near-perfect condition)

How is it possible that a new physical book is cheaper than the ebook!?! The only explanation is that DRM prevented the existance of a second-hand market letting prices sky-rocket.

The key point here is first-sale doctrine. Physical goods could always be resold, and the used books market kept book prices (both sale and rent) in check. Ironically, until the internet peer-to-peer resale was impractical, so second-hand stores came in as "trackers" and libraries as both "trackers" and "seeds" :-)

Anyway, I see this as a counter-point to the replies claiming some customers want DRM because it allows renting which at lower prices than buying. Without DRM, giving up a film you watched to save money wouldn't have to be a justifiable business model for publishers — it'd be an inevitable result of your ability to sell it. ("Selling your copy" also doesn't make any sense in a digital world. But it's no more absurd than the concept of "buying a copy" in the first place, and as long as copyright enables first sale we are better off with second sale freedom.)

I suppose video renting only exists because film studios had to compete with themselves selling physical media. (Scary realization: If Hollywood embraced exclusively digital delivery, they could be more evil!)

Cyclone_• 12 years ago

Wonder what Brendan Eich would have thought of this.

icebraining9• 12 years ago

Wonder no more: https://brendaneich.com/2013/10/the-bridge-of-khazad-drm/

He said essentially the same thing; "We are working to get Mozilla and all our users on the right side of this proposed API. We are not just going to say that users cannot have access to streaming Hollywood movies, as that is a good way to lose market share and not have any product with which to uphold our mission."

fiatmoney2• 12 years ago

It's very important that users be able to disable ALL of this functionality with a simple compiler flag. Not just disabling it in the process.

We've seen the failure of "sandboxing" over and over again, and especially with a closed-source, certain-to-be-compromised payload, it's guaranteed that at some point it will be breached.

ibotty• 12 years ago

did you read the blog post? you have to actively consent in installing that plugin to use it. without plugin the sandbox is code without attack surface.

fiatmoney2• 12 years ago

It's unclear to me from the post that the sandbox code will be unbundled from Firefox. Furthermore, it should be possible to distribute a compiled version of Firefox that doesn't have the ability to install the module in the first place, with a minimum of effort.

If you don't enable it by default, but the first time a user visits any website with a video ad they get a clickthrough that downloads and installs it, a huge portion of the user base will end up with it installed. This is less than desirable if you care about security.

I'm sure security- or ideological-focused distros will do a version of this anyway, but it should be supported upstream to segment the code as much as possible so as few vulnerabilities leak into the "main" codebase as possible.

oscargrouch• 12 years ago

All the system is rot from the bottom up.. The Honcho's (tm) are putting their dirty hands and corrupting all over .. even the things we take for granted as community driven and serving for a greater good

Dont use Netflix, Dont support DRM, fight for DRM free software..

We took millions of years to make copy and cloning of any information free(as in freedom and in beer) and now some bastards want to turn this into a crime just because they want to profit?

Its just the beggining of something really bad that can corrupt all of the good things we take for granted now, as free education, knowledge sharing and the free flow of information

pekk• 12 years ago

Mozilla can't hold the line on DRM. but Mozilla has no trouble holding the line on the Javascript monopoly.

kipple2• 12 years ago

Scuse my ignorance, which JS monopoly? What is Mozilla doing?

I love mdn for my js reference needs, something to do with that?

icebraining9• 12 years ago

I believe pekk's talking about not supporting any other client-side languages besides JavaScript (e.g. Dart, PNaCl, etc).

pirate_arrgh• 12 years ago

You know, I've long avoided the Pirate Bay for movies and other copyrighted media, and I pay monthly for month Netflix and Amazon Prime.

However, if Netflix is going to push shit like this and PMP in our faces, then I think I'm going to have to take a look at this Popcorn Time app. Particularly with PMP, it's getting to the point where it's hard for "media-compliant" Linux users to run our open source OS and legally access media at the same time.

josteink3• 12 years ago

This is terrible news from end to end.

To solve it, we need to tackle the root problem and not blame the browsers: those who want to infect our open web with DRM.

Cancel your Netflix subscription. Let them know why. Same with Hulu. Same with amazon video. same with anyone who tells you to that your open web is less important than their unwillingness to embrace the new, digital frontier.

Don't give money to the asshats who push this crap. Simple as that.

This is only the beginning if you let them in. What will you accept next? Drm infected Images? HTML infected source which can only be decoded on windows? This is not the end. The line must be drawn and it must be drawn now.

shmerl30• 12 years ago

While I share your sentiment and never use any DRMed services to vote with my wallet, the critical mass of users don't care. It gives an ability to crooked publishers and distributors who oblige them to get away with unethical practices like DRM.

jedberg2• 12 years ago

Canceling your streaming service subscriptions won't be sufficient, even if everyone did it.

You have to stop consuming Hollywood content. Stop going to movies. Stop watching TV shows. Stop listening to recorded music.

Then you might actually make a difference.

The streaming services are just stuck in the middle here -- Hollywood won't sell them, or anyone, content without DRM.

DRM actually makes sense for a streaming service, where you only have a temporary license to the content anyway. You're buying the right to watch or listen one time -- how is that supposed to be enforced?

iwwr• 12 years ago

You talk as if there is no other way to consume film content on a computer...

shmerl30• 12 years ago

As discussed below, DRM never makes sense since it's not effective anyway.

rmc• 12 years ago

Start pirating content. Punish them in their pockets. It's all their care about.

nullc• 12 years ago

So long as you're still consuming it you're still propagating the resulting culture, and encouraging other people to pay for it. Not everyone is in a position where they can so easily choose to flaunt the law.

It's best to support liberally licensed things and other alternatives; then your friends and family can share in them without taking the bigger step of choosing to ignore the law.

Stately• 12 years ago

has that ever worked? (honest question)

iandanforth• 12 years ago

Why is this even an issue? Sure it's offensive. But it's offensive like someone flipping you off, not like them breaking your leg. I am aware of zero freed-media channels that begin with web content. Music, movies, TV shows; all of the content that isn't available through corporate means is available online from people who don't copy the bits off of their browsers.

This DRM is trying to plug a hole that isn't leaking.

wmf5• 12 years ago

I saw an interesting comment from gerv @ Mozilla: "Current plan: CDM can scrape memory to check sandbox is a sandbox it trusts." http://lwn.net/Articles/598640/

jgon• 12 years ago

This is a sad day for the web, but it was honestly one that was inevitable, and one that we all had a hand in making. If you want to know why we have DRM in the web, step 1 is taking a look in the mirror. Mozilla does not represent a majority market share of browser users, and so their voice in the W3C can be over-ruled by the voices of the other stakeholders, among them 3 enormous corporations with substantial media interests.

What follows is harsh, but I believe it to be true. Feel free to tell me that I am wrong, because I fully admit that I could be letting my emotions speak and I could be wrong.

Back in the day the web was ruled by a monopoly and it sucked. Mozilla released firefox but the web only broke free of microsoft's control because people like us did the work to break that control. I started using firefox, and I helped get most of my family members onto it. And many of my tech savvy friends did the same. Slowly but surely Mozilla's market share grew until it reached the point where Microsoft had to react and start to implement web standards, because if they didn't people weren't going to wait for them. They were going to switch to Firefox. And for a brief time we had the promise of a global network for the distribution of information not controlled by a single large corporation, but worked on by a committee which had a large part of its membership come from a public benefit corporation, whose only interest was empowering people to use that network to enhance their lives.

The web exploded, and fearful of being left behind large corporations got into the game with their own browsers. And rather than learn from what happened last time we let a large corporation get majority user share, we, and by "we" I mean you and I and all of the other people who should know better, went right for it.

Google released a cute cartoon describing the inception of chrome, beginning with hiring away people from Mozilla, talking about all of the great things their browser would provide. Microsoft started up development of IE again, and Apple released Safari. A lot of us looked at Firefox and said "Thanks for helping to save the web as we know it, but Chrome is so much more minimal! Safari as a great look and feel! See ya later". Richard Stallman gets a lot of flack around here for his eccentricity when it comes to computing, but goddammit the man can see past his own nose and understands that taking a dump on the only body advocating for you and I in favor of switching to something on such trivial concerns as "look and feel" is a great way to end up right where we are today. Where Mozilla has been marginalized so much by the relentless rush to Chrome that Google can go ahead and implement a DRM scheme on its proprietary OS and then force that through the Web Standards body with the help of Apple and Microsoft. When Mozilla doesn't have enough market share to stop it, because we've all switched over the Chrome based on Octane benchmark scores, and switched over our parents and friends. Where I routinely run into "desktop" sites that are straight up broken in Firefox and fine in Chrome because people can't bother with anything other than webkit prefixes, and where the mobile web is an even bigger disaster of Chrome/Safari specific junk.

So a few years from now, as you continue to bask in the glow google's super minimal interface and safari's incredible smoothness, as Chrome sends your browsing data back to Google and DRM starts to leak into other areas of the web (want to save that image? Sorry! Want to copy this text? Protected! Don't even think about looking at the source) cast a thought to Mozilla, probably still working away to do the best it can for you. Then ask yourself if selling out the web was worth it for the handful of beads you got from all the interests that wanted to close it down and lock it up, and if all the smoothness and look and feel in the world was worth it for the promise of what the web might have been had we not let it slip through our hands.

natch• 12 years ago

we vary this unique identifier per site (each site is presented a different device identifier) to make it more difficult to track users across sites

What a load of horseshit. They know perfectly well that different identifiers can be tied to the same user with other shared identifiers like advertising tracking identifiers, and yet they pretend they're somehow solving the problem.

Worse, the focus on privacy, while fine, misses the point. Users WANT to be able to download and save content for later consumption. Enabling the prevention of that is not a user friendly act. Sure, content owners have to cope with content sharing and piracy. But maybe that's for the best. Really great content owners like O'Reilly Publishing are providing non-DRMed content today and doing just fine. Create more value than you capture.

Something is rotten at Mozilla. They should be fighting this tooth and nail, but they're going the way of the money. And giving Adobe more credibility in the process... ugh, talk about adding insult to injury. This will mark the demise of Mozilla as a respectable organization.

yuumei• 12 years ago

So this DRM is going to use the hardware TPM on cpus I would imagine. This would make it very difficult to break. Well done everyone that supported UEFI!

Reconciling Mozilla’s Mission and the W3C EME

Related Stories