YouTube Ditches Flash, and It Hardly Matters

https://www.eff.org/deeplinks/2015/01/new-drm-boss-same-old-boss

by sinak • 11 years ago

381 183 11 years ago

jsnk• 11 years ago

I hear what the proponents of non-DRM browsers are saying, but for media streaming companies content is their bread and butter. I am not sure what the alternatives are.

Content providers will stick with technologies like Flash because HTML5 alone could not provide EME. Lack of such feature set HTML5 backwards because huge content providers would shy away from using web as the dominant platform of media delivery.

bobajeff• 11 years ago

Actually, for most online video sites users are their bread and butter. (Since they are ad supported) In fact users also provide the content in most cases.

vlad0032• 11 years ago

I'm not sure what the benefit of HTML5 video is if you still end up being forced to use some proprietary component. You ditch Flash but now you have to run some DRM software.

And there's so much more to HTML5 than video; I disagree that lack of DRM video support would set the rest of HTML5 back in any way.

EDIT: I guess the sandboxing aspect of EME is a significant improvement over Flash running as a plugin.

notatoad• 11 years ago

The benefits of html5 video are practical ones: it simply works better than flash does. It plays without stuttering, the audio works properly, it doesn't steal my mouse focus. Also, it doesn't get webcam permissions by default, or all the other crap that comes along with flash. Sure, its still DRM, but flash was terrible for plenty of reasons that aren't DRM.

spyder• 11 years ago

HTML5 video works on phones and tablets

awalton• 11 years ago

I hear what the proponents of non-DRM browsers are saying, but for media streaming companies content is their bread and butter. I am not sure what the alternatives are.

And the DRM does absolutely nothing to stop anyone from doing whatever they want with it. DRM punishes paying customers at the expense of being a slight pain-in-the-ass for pirates. Plain and simple: they delivered content to my computer and I have a key to decrypt it - there's nothing stopping me from doing whatever I want with those bits but the time to break their silly DRM scheme.

Had Apple, Google, Netflix et al. the backbone enough to stand up to the media companies, we'd never have been inflicted with such stupidity. Now, Google's taking it upon themselves to start using their own DRM module with their own media - so much for the company that prided itself on Do No Evil.

sounds• 11 years ago

Great argument. One point, though: it's "Don't be evil." Are you able to say you "do no evil"?

geofft8• 11 years ago

How is that punishing a paying customer?

It's a quirk of classical information theory that you can't transmit a piece of data for a limited period of time. As an approximation, they apply a silly DRM scheme that takes time to break, and ask customers if they are willing to pay for time-limited access.

Unlike with DRM on music downloads or (worse) physical copies of software or games, there's no expectations mismatch here. If you sell a download, the average buyer expects to be able to copy that download, etc. If you stream a movie, the average buyer no more expects to be able to retain a copy than the average movie-ticket holder does. They didn't think they paid for a copy of those bits for all time.

There's nothing stopping someone who visits a movie theater from doing whatever they want with those photons, other than the time to build a sufficiently concealed camera, is there? And pirates do show up to movie premieres with concealed cameras... but would you argue that the security guards stopping you from carrying in a giant camcorder are "punishing paying customers" while not effectively deterring pirates?

pjmlp• 11 years ago

So what, what guarantees you get a EME module of your OS of choice?

hsivonen2• 11 years ago

Nothing.

thristian3• 11 years ago

Over thousands of years of human history, new technologies have changed the ways people communicate, from language to writing to the printing press, and so on. Every change shifted the economic balance, so things that once were prohibitively expensive became easy, and people who derived economic benefit from former scarcity became disadvantaged.

I hear what the proponents of DRM-encumbered browsers are saying - media streaming companies control huge chunks of our popular culture, and significant political power, and it's expedient to give in to their demands and stop threatening their business model. But when I look back at the last thousands years of technological progress, I cannot bring myself to say "yes, this is good enough. We should legislatively freeze our technology at early-21st-century levels forever." Our civilisation has benefited from technology so much already, I can't in good conscience deny people the benefits of future technology, even in exchange for the right to stream Game of Thrones.

anigbrowl7• 11 years ago

Media producing companies that have no way of safeguarding their revenue stream would like the technical threshold for copying to be at least a minor deterrent, because otherwise people have no incentive to pay them; many many people are in fact OK with being freeloaders.

I'm so sick of seeing Game of Thrones offered as the standard example. Sure, HBO has more more money than any of us would know what to do with. I, on the other hand, make my living working on films with budgets that only amount to a few hundreds of thousands of dollars, and believe me that does not go very far - the lower cost of digital vs. celluloid film is only one line item in the production process, whereas you still have to pay for locations, costumes, props, housing, transport, food, lighting, and a whole bunch of other things before you even get to handing out any wages.

It's very, very hard to monetize a low-budget film. And there's constant downward pressure on production budgets, because indie films don't usually have fat box-office payoffs, and instead depend on small-scale releases in festivals and the art-house cinema circuit, followed by (you hope) some international box office and (you really hope) a long tail of DVD/streaming sales. And that long tail is highly vulnerable to piracy, and the existence of piracy is a big deterrent to investors.

So when you're saying Big Studio makes enough money with their latest superhero franchise movie, or HBO makes enough money with their huge base of cable subscriptions, and so you don't feel bad about pirating Superhero 4 or Game of Thrones well sure, I understand that - none of the producers are in any danger of losing their shirts, everyone on the cast and crew got paid handsomely at the fairly generous rates their guilds/unions have negotiated over the years, and the shareholders still make plenty of money and get a nice dividend check every quarter.

On the other hand, lots of smaller content providers are getting fucked financially because it's a lot harder to answer the question of 'how will investors make their money back?' than it was a few years ago. So spare me the stereotypes of evil media barons trying to stop the brave plucky technological underdogs. That same technology is also massively disruptive to creative professionals and small businesses that work outside the Big Media tent, and actively hinders their ability to make a living.

chx• 11 years ago

"Piracy is a service problem." -- remember that? There's nothing on Netflix you can't download illegally. People would pick Netflix still because it's a superior experience to what most people perceive as shady sites.

This has always been so with DRM: the only ones it inconveniences are the paying customers. Incredible stupidity.

anigbrowl7• 11 years ago

I use Netflix every day. The DRM doesn't inconvenience me at all. I'm sure someone will be along in a minute to tell me they have to go down a salt mine and they won't have any internet down there and it's such a tragedy that they won't be able to finish watching the thing they started watching on Netflix because stupid DRM.

Sorry, but those are bullshit first world problems. Your life is not significantly impacted by this.

copsarebastards9• 11 years ago

I hear what the proponents of non-DRM browsers are saying, but for media streaming companies content is their bread and butter. I am not sure what the alternatives are.

The alternative is non-DRM browsers. EME does nothing to protect content, so the "content is their bread and butter" argument doesn't work.

Content providers will stick with technologies like Flash because HTML5 alone could not provide EME.

Or, they'd give up on EME because all the major platforms were hostile to it and it provides them no defensible value.

Lack of such feature set HTML5 backwards because huge content providers would shy away from using web as the dominant platform of media delivery.

Including EME sets the web platform back because we no longer have control of that part of our browsers.

eridius6• 11 years ago

Or, they'd give up on EME because all the major platforms were hostile to it and it provides them no defensible value.

That's absurd. Netflix would sooner stop supporting web browsers on desktop OS's before they started allowing DRM-free streaming. Regardless of your own view on DRM, Netflix's licenses to the content they provide almost certainly requires the use of DRM, and the companies that own the content would never be willing to relicense them for DRM-free streaming.

Without EME, Netflix would be relying on proprietary browser plugins forever, and if a platform with a significant userbase appeared that didn't support any form of proprietary plugin, and they wanted to support that platform, they'd develop their own proprietary application for it instead of providing DRM-free streaming (think of how Netflix has applications for mobile OS's and even consoles, both living room consoles and handheld consoles).

davexunit2• 11 years ago

I am not sure what the alternatives are.

Refuse to use Netflix and co.!

Lack of such feature set HTML5 backwards

No, giving in on DRM set it backwards. The web is intended to be "free and open", which means that DRM is not welcome.

geofft8• 11 years ago

One thing to note is that (last I heard) both Chrome and Firefox sandbox EME modules fairly tightly. Flash is a browser plugin, which means that it usually injects code into the browser itself, and runs with full privileges on your computer, just as much as your browser does. This is what makes Flash such fertile ground for exploits of all kinds, and also makes it bad for your privacy because it has direct access to your webcam, microphone, clipboard, supercookies, etc. — anything the browser can do, Flash can do without asking. If it asks, it's out of the kindness of its heart, not because the browser has any say.

Chrome and Firefox's sandboxes, meanwhile, are both open-source. You can inspect what powers the EME module might possibly have, and know that it can't gain any more. A vulnerability in the code is unlikely to be able to do anything other than pirate your download of Game of Thrones — and that's assuming it even has general-purpose network access. Ideally, a vulnerability would be able to do nothing other than modify the video you see, but the remote site could achieve that by encoding a modified video in the first place.

As far as the general moral arguments about DRM go, it's true that the new boss is the same as the old boss. But the bulk of the EFF's argument against Flash in this blog post is about security, not about open content, and it's important to acknowledge that EME is a significant step forward. The new boss is sitting in a tightly locked cage.

detrino• 11 years ago

Flash for Chrome uses the PPAPI and is sandboxed.

geofft8• 11 years ago

That is a fair point, but I would also consider that a (limited) victory on par with the (limited) victory of moving from Flash to EME, and I wish it got more press. The people who are implementing sandboxes are doing massively effective work to improve the security and privacy of everyone using the web. Chrome has been quite active here and I don't think they can be thanked enough.

That said, PPAPI is Chrome-only; EME is a standard, and Mozilla's implementation even outlines a way for other browsers to integrate the EME module Mozilla uses, plus their sandbox, into their own browsers.

ris3• 11 years ago

People talk a lot about "sandboxing" things as though it's magical fairy dust.

jumpwah• 11 years ago

When Cameron wanted encryption to be illegal, would that mean EME would also have been illegal?

geofft8• 11 years ago

Didn't he only want encryption without a government backdoor to be illegal?

I don't really think anyone has a problem with giving the latest episodes of Homeland and Downton Abbey to our political elite.

ianlevesque2• 11 years ago

It definitely is in a tightly locked cage. Firefox even generates the device fingerprint itself rather than allow any machine access. An EME module cannot access the Internet, nor store data to the hard drive. There's a detailed writeup here: https://hacks.mozilla.org/2014/05/reconciling-mozillas-missi...

belorn3• 11 years ago

An interesting technical claim to sandbox a process in such a way that it has free access to display drivers and hardware modules (tpm's) but not the host system, network or hard drive.

I would like to see a security audit on that claim.

SixSigma4• 11 years ago

This is a bad thing.

No saving means :

No time shifting, no device shifting, no legal fair use.

walterbell• 11 years ago

DRM and sandboxing will also be using hardware enclaves within the x86 processor, https://news.ycombinator.com/item?id=8425178

copsarebastards9• 11 years ago

Chrome and Firefox's sandboxes, meanwhile, are both open-source. You can inspect what powers the EME module might possibly have, and know that it can't gain any more.

Yeah, that's not true[1]. Sandbox security is not perfect.

Sandboxed plugins are definitely are an improvement in security over non-sandboxed ones, but running untrusted code in a sandbox is still running untrusted code on your machine. At the very least that has to be considered one level of privilege escalation that's just being handed to malicious coders for free.

Sandboxes are great. I'd love to see open source code run inside sandboxes, because even if the code has been audited, because even if I know the code isn't trying to do anything bad, it might have vulnerabilities that let other people do bad things. Running closed-source EME code inside a sandbox is still an unnecessary risk, though, because we have no way of verifying whether that code is secure and in fact that code might be an attacker itself.

[1] http://www.zdnet.com/article/pwn2own-2012-google-chrome-brow...

vertex-four2• 11 years ago

running untrusted code in a sandbox is still running untrusted code on your machine

asm.js and various obfuscators allow websites to do this in the first place with closed-source code, with a far larger attack service than the EME sandbox. In not a lot of time from now, they quite reasonably could.

comex• 11 years ago

The JavaScript VM is also a type of sandbox, whose security in every browser is compromised on a depressingly regular schedule. It's true that the EME sandbox is an additional risk, but it's only supposed to run a single piece of software from (in Firefox's case) Adobe, which is probably not malware, and would thus have to be exploited before the strength of the sandbox made a difference. It probably can be exploited, but considering that attackers can run arbitrary evil JavaScript directly... EME is only a small addition to the overall risk profile.

What I think is more important, from a security perspective, is that EME defeats (or attempts to defeat) attempts to get by without JavaScript or the complexity of modern browsers altogether. YouTube doesn't work as is without JavaScript anyway, but one determined not to use it could just download all their videos with youtube-dl; until someone comes out with a reverse engineered Widevine or Adobe Primetime or whatever other long-i-festooned DRM systems these sites support, this plan won't work for DRMed video.

zobzu• 11 years ago

Its more about freedom than security tho. Really if anything, EME is about security for vendors, not users. Really, not much to do with the fact that it's sandboxed. Its not like if proprietary, freedom-restricting software was suddenly ok because there's some kind of a sandbox around it.. as if the only issue with these was that they're poorly coded and supported.

vertex-four2• 11 years ago

as if the only issue with these was that they're poorly coded and supported

A major issue is that arbitrary code can do arbitrary things, up to and including installing rootkits on your machine (for example, the Sony rootkit debacle). The sandbox means it can only do what the sandbox allows it to - in the case of Firefox's sandbox, that's very little.

"I should be able to watch whatever content I want on my system without installing proprietary software, even if that software is highly sandboxed and can't even see anything on my system and can't cause any permanent changes" is a political and moral issue more than a technical one.

AnkhMorporkian2• 11 years ago

No user is being forced into using this. I haven't really followed this argument from the beginning. Philosophically I despise DRM, but pragmatically as long as it isn't forced on users as the only option, then I don't see any issue with an extension having that option being available.

geofft8• 11 years ago

Really if anything, EME is about security for vendors, not users.

EME as originally conceived is about security for vendors, yes. But Firefox and Chrome, which take their roles as user agent seriously, made sure the spec is one that they can also implement securely on their end. This is a ridiculously huge improvement over NPAPI.

Browser plugins can restrict your freedom in two ways:

1. They can monitor and restrict what you do with the content you're accessing through the plugin.

2. They can monitor and restrict what you do with ANYTHING ELSE IN THE BROWSER OR ANYWHERE ON YOUR COMPUTER.

EME-restricted video can do 1, but cannot do 2. This is not a complete victory for freedom, but it's a significant step forward.

Most of us do not live in a free-software utopia where we have direct control over every part of our machine from the firmware on up. (Although I have a lot of respect for the people who are trying to get us there!) Even if we're running a free OS, we assume, against our better judgment, that the firmware is doing only what it should be doing. If it's not, then it throws the rest of our freedom out the window.

Sandboxing EME allows us to ensure that one non-free part of the system, if we can't get rid of it, is restricted to doing only what it says it can do. This is a lot better than the status quo for any mixed free/non-free system (including free OS/non-free firmware). It's not quite the same as getting rid of it or making it free, but it's certainly not nothing.

eridius6• 11 years ago

I would be shocked if Safari did not also sandbox EME just as tightly as Chrome and Firefox. Of course, Safari isn't open source, but a sufficiently knowledgeable person could locate the background process Safari uses for EME (it probably has a very distinctive name) and check what the sandbox it uses is.

SixSigma4• 11 years ago

What does Theo think?

You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes.

dredmorbius4• 11 years ago

The virtualization layer becomes a single point of concentration for both security and attack. That offers opportunities to reduce the attack surface and opportunity.

Net net, given the choice of extensive plug-ins vs. virtualization, I'll go with the latter.

userbinator• 11 years ago

AIUI, EME is basically a standard for interfacing DRM plugins, so instead of the one implementation (Flash) of it that was around before, we might end up with a wide variety of DRM modules? That certainly doesn't seem like a better situation than before, where basically all the RE efforts were focused on Flash's DRM.

asadotzler3• 11 years ago

Your assumption here about going from one DRM implementation to many is wildly off the mark.

There have been several major video DRM solutions in widespread use for many many years including Adobe's Access (in Flash, and other places) Microsoft's PlayReady (in Windows, X-box, Silverlight, etc.) and more recently Google bought WideVine for its DRM offerings and has spent the last 4 or 5 years building that into the Google Chrome and Android platforms.

Pretty much every major video streaming service was/is using a different DRM implementation. That's nothing new at all.

Your suggestion that somehow there's going to be a shift from one to a lot more DRM providers thanks to EME is uninformed and unfounded.

hsivonen2• 11 years ago

With NPAPI each site picked one plug-in that worked in multiple browsers. Another site could pick another single plug-in that also worked in multiple browsers. With EME, each browser supports some DRM(s) and there's no single DRM supported by all browsers, so sites need to support multiple DRMs to reach multiple browsers.

slang800• 11 years ago

And through all this effort to "protect their content", they still haven't managed to stop people from bypassing the DRM and giving the videos away for free in torrents.

I have a hard time seeing how implementing DRM provides any value to media companies, other than a false sense of security.

vlad0032• 11 years ago

It's possible the false sense of security is worth more than people think. It lets them say "hey, we tried".

geofft8• 11 years ago

Certain companies have been extraordinarily interested in implementing WebCrypto without mandating HTTPS. Which is to say, a man-in-the-middle attacker could trivially modify the JS that calls WebCrypto and cause different operations to be performed.

My suspicion is that they have contractual agreements with the non-technical folks in the studios that they have to "encrypt" content, and the technically-competent redistributor has no direct interest in the crypto being sound. If the API gave them 256-bit military-grade AES encryption, but only in ECB mode, they'd probably use it.

jeremyjh• 11 years ago

I think this is a very important point. These media companies have not been able to extract as much rent from their IP as they could ten years ago, and their shareholders are not happy about that. They absolutely have to try something.

pkulak3• 11 years ago

Right click -> Save As is a tad easier than finding a torrent.

AnthonyMouse5• 11 years ago

Right click -> Save As is only possible after you've paid.

quadrangle2• 11 years ago

The purpose if DRM is not to stop people from illegally copying. The purpose is to control and manipulate the legal users and limit their freedoms they would otherwise legally.

Yes, DRM developers lie to us and claim that this is about stopping infringement. But that's only a pretense. They know that it only impacts non-infringing users. But they like having more control and power over the non-infringing users.

See http://www.defectivebydesign.org/faq#purpose

kmonsen• 11 years ago

That is also the purpose of door locks btw, and I am assuming you have one of those on your door.

Rapzid• 11 years ago

Accurate. Here are some wonderfully managed rights brought to you by DRM:

* What devices and equipment can view it

* Time limits on watching

* Regional lockouts

* Time shifted viewing

The movie industry fights tooth and nail to "manage" our rights, not just with DRM by plain RM. In NZ for example there is a ban on parallel importing films for a period after release! Here is something interesting: http://www.parliament.nz/en-nz/pb/debates/debates/50HansD_20.... Choice quote: "The 5-month ban will effectively give cinemas a further 1 or 2 months to exclusively screen films without competition.". Feast your eyes on the pandering! There is no "transition" period going on. It's the movie theatres using laws to prop up their new business model of stealing 20 minutes of your time and selling it to advertisers, after taking 20NZD admission.

briandear• 11 years ago

It's interesting because this sounds very similar to control legislation in terms of which citizens it affects while not having much effect on criminals who, by definition don't care about the law.

I think your point is exactly correct, DRM does little, if anything from stopping illegitimate actors, but it does serve to manipulate and control legitimate users (for example preventing them from using the DRM content on certain devices, thus requiring them to potentially purchae it again.)

snowwrestler• 11 years ago

I know this is a popular way to frame the argument against DRM, but I have never actually seen any evidence that DRM companies actually think this way. I mean like a quote from an executive, or an internal memo, or even an anonymous statement from an employee.

I think it's a much simpler explanation that companies really do hope that DRM will reduce casual illegal copying and sharing, even though they know it can't absolutely stop determined people.

bjelkeman-again• 11 years ago

Corporate execs, politicians or government officials rarely look at the world with the same eyes as someone who reads HN. They belive that DRM provides value as otherwise pirating content will be rife. It is sort of built into most of these peoples world view, in a similar way that hard nosed capitalism is nearly the only viable narrative for a lot of them.

sowhatquestion• 11 years ago

I distinctly remember being upset about DRM in the '00s, back when it was being used to place onerous restrictions on content that people had ostensibly "bought" (CDs, DVDs, AAC audio files, etc.). Now that it's being used to prevent people from saving streams... I hate to say this, but please remind me why I should be upset? I never had any illusion of "owning" a stream. Not only that, I would rather stream than own in most cases.

logn2• 11 years ago

Because it's a lot harder to make a competing web browser now. You'll have to buy the secret binaries from one of the DRM providers, if they'd even be willing to sell.

geofft8• 11 years ago

Firefox, which is open source, both sandboxes the Adobe decryption module—giving the browser control over the world that the Adobe module sees—and fetches it at startup from Adobe's site. It seems almost impossible that you'd be unable to hit the same URL from your own browser and put it inside your own sandbox such that the module can't tell it's not running inside Firefox. You have the hard constraints that the module can't examine the outside world except through the sandbox, and the sandbox itself is open source.

Edited to add: Widevine, the (Google-owned) decryption module Chrome uses, has no license fees. http://www.widevine.com/

anon1385• 11 years ago

I'm not a fan of DRM, but I don't find this argument very convincing. It's pretty much impossible for anybody to create a new mainstream browser at this point. The standards are huge and complex and require seriously optimised implementations to get acceptable performance.

Which is why we only have a handful of competitive browser engines today, and all of them are based on code at least 15 years old. The last time somebody created a serious new mainstream browser (that wasn't just a re-skin of an existing one) was 7 years ago, and it was still largely based on existing code, despite having the backing of one of the biggest tech corporations on the planet. The standards have become vastly larger and more complex since then, and security and performance expectations much higher. Just keeping up with all the new standards is hugely expensive. The cost of a DRM module from Adobe is surely the least of your worries if you want to create and maintain a new browser.

fafner2• 11 years ago

To make matters worse: Three of the four major browser vendors are also DRM vendors. Google, Microsoft, and Apple all have their own DRM modules. EME therefore gives them a lot of control over the browser market and media market.

Four of them are also working on their own mobile devices/OS. Which gives them even more incentive to lock out competition.

guelo• 11 years ago

The basic principle that we have lost is that the standardized part of the web has always been fully open. You can look at the source of any page, figure out how some cool CSS or javascript trick works and copy it. You can download any image you see and modify it. This in contrast to, for example an iPhone app, it's closed, unmodifiable, secret, hostile to tinkerers. Flash video was closed but it was not a web standard, this is.

asadotzler3• 11 years ago

First, it is simply not true that the standardized parts of the web have been fully open. There have been scores of proprietary features, including those with no source availability or even documentation, that have become web standards because browser vendors built or reverse engineered them and web developers used them.

Standardization is a good thing, but you're being a bit selective claiming web standards have always been open and source available. It doesn't always happen that way. It didn't happen that way for image codecs, for example.

Second, plug-ins most certainly are and have been a Web standard.

NPAPI was implemented in multiple browsers from multiple different vendors and has been used by dozens of major software companies and thousands of lesser companies, commercial and open source, for browser integrated features.

That you don't consider de facto standards to be standards doesn't mean they aren't.

ChuckMcM• 11 years ago

Interestingingly it seems Youtube is still using Flash in its pre-roll advertisements unless I'm missing something obvious. Those videos get the 'f' from flashblock and won't view unless it is enabled.

pkulak3• 11 years ago

Yes, EFF, we're still not living in a content wonderland where Hollywood studios send their blockbusters to people's browsers in naked <video> tags. Shocking, I know.

joshAg3• 11 years ago

Look, if they want to make a plugin that understands their DRM scheme or some standalone app that's basically just a scaled down browser with support for a <drm_video> tag, they can tilt at that windmill all fucking day for all I care.

But I still need a <video> tag that works like an <img> tag in that there's at least I format supported by all major broswer venders that works for that tag, that lets me easily save the video for offline viewing, and is completely unencumbered by patents or licensing issues, so anyone else can make a browser supporting it. If that means I have to use a tag called <supercalifragilisticexpialidocious> instead of <video>, I don't really care. I need that functionality. The web needs that functionality.

asadotzler3• 11 years ago

You have that functionality thanks to the <video> tag and H.264 and AAC in MP4. That seems to meet all of your requirements. Am I missing the problem? EME and DRM are not required to make that work in Firefox, IE, and Chrome.

pkulak3• 11 years ago

That's exactly what they did. Except it works in every browser and every producer doesn't have to build their own custom solution.

AnthonyMouse5• 11 years ago

Why are they calling EME "locks"? It isn't locking anything. It's obfuscation. The most relevant physical analogy would be smog. They should call it what it is; digital smog.

eridius6• 11 years ago

It is a lock. You open it with a key. Just like a physical lock. And just like a physical lock, there are ways to force it open without the key. And just like a physical lock, forcing it open without a physical key is (usually) illegal.

_ikke_• 11 years ago

Yes, but it's a lock where they have to provide the key too, and the only way to prevent you from manually opening the lock is obfuscating this process.

malka• 11 years ago

And, like a physical lock, you need to provide the users with the key, so that they can use the product.

hyperion2010• 11 years ago

Somehow this reminds me of my long running rage against all things webapp and javascript. Companies have started using the browser as a substitute for an OS because it is easier to distribute working code to multiple platforms on a browser. So what do the drm people target now? The browser: aka operating system 2.0. And the thing that is scary is that people don't realize this and think "oh, its just W3C, its just a single program on my computer, they aren't really attacking general computation!" Spoilers: browsers act as virtual machines for probably 90% of all calculations that run on an average pc these days.

ck2• 11 years ago

The nice thing about youtube is it also encodes most videos in webm format so it still plays on XP with Firefox and some old phones

Other sites like vimeo only do mp4

t0mas88• 11 years ago

Adobe got Flash (once one of their main products) wrong on the security side so many times that we can't even keep count anymore. Let alone the horribly bad performance of flash and the hack-slack way they added features. Why on earth would anyone want to trust this company to build another proprietary blob of their sub-par code into all browsers? They've proven to be incompetent in many attempts, let's not give them a 32nd chance.

silon5• 11 years ago

I notices Firefox sometimes starts busy looping on 2 cores while playing youtube (usually when "buffering"). IMO, they should really move the decoding threads into separate processes so they can be restarted easily (just like Flash was).

dredmorbius4• 11 years ago

EFF's view is that we've been sold down the river with EME (Encrypted Media Extension).

Except ... that I seem to be able to access most online video content (certainly on YouTube, Vimeo, and other major sites) via youtube-dl.

And hugely prefer to do so. It's much more useful for me to be able to queue, speed up / slow down, pause, resize and otherwise manipulate video with consistent controls than to have the limited (and varied) interfaces various online video / multimedia sites offer.

I've got a video playing as I write this, well, paused, at 133% playback speed, in a small 250px x 190px window -- when I can give it my focus again I'll simply mouse over it and tap 'space' to resume playback. If I want to skip back a few seconds, or a minute, the left or down keyboard arrows do that for me. As they do for all video I play. I can also normalized audio levels (many are too low, this one's actually got a tendency to clip), and more.

belorn3• 11 years ago

If you are going to use unauthorized methods to gain content, there is many convenient ways to do so. Most are not effected by DRM.

The issue with DRM on video is one which lawful consumers of content has to deal with, and those who run programs which is infected by said DRM.

dredmorbius4• 11 years ago

Um. Who elected you god and decided youtube-dl is "unauthorized"?

I was actually inquiring as to how such use is impacted by the decision. I've found few or none. Then again, there's little commercial content I've interest in regardless.

makomk• 11 years ago

The reason you can access most online video content via youtube-dl is that historically speaking, YouTube and most other Flash-based video players actually had no DRM at all. Flash's DRM support was crappy, unreliable and expensive to license and few places used it. I think I've literally come across one site that used their proper DRM, at which point I discovered it didn't actually work on my PC. (A handful more use RTMPE, which is hilariously broken but enough to block youtube-dl out the box.) DRM's becoming a lot easier with HTML5, and a bunch of sites that didn't previously have robust DRM are now planning to start using it.

kelnos• 11 years ago

It's a little weird that the EFF is using YouTube's move to HTML5 video by default to attack EME, considering that YT doesn't require EME...

(Yet, anyway.)

idlewan• 11 years ago

It's maybe to point out some of the irony of "Hey, let's accept another proprietary blob from Adobe" when it's not even needed anymore now.

blakeja• 11 years ago

Can I uninstall Flash at this point? What do I really need it for?

cpeterso2• 11 years ago

Most Facebook games require Flash.

Aoyagi• 11 years ago

Well, hopefully using the Flash player remains an option.

orblivion3• 11 years ago

I think this article seems to act as though ditching flash just happened to coincide with adoption of this new EME thing. The issue is that no matter how much we kick and scream about user freedom, business interests are business interests. Economics are economics. There just isn't enough user demand for freedom to overcome the loss to businesses of losing control of their content. In order to win this, I think we may need to come to terms with this. Perhaps it means trying even harder to inform the public and increase demand for freedom, but maybe it means coming up with alternate ways to monetize, or alternate ways to produce which circumvent the need to monetize.

copsarebastards9• 11 years ago

This is a misrepresentation of the problem here. You're restating the corporate arguments.

There just isn't enough user demand for freedom to overcome the loss to businesses of losing control of their content.

DRM doesn't prevent businesses losing control of their content. Orange is the New Black has, AFAIK, only ever been distributed through EME, but it's all over the Pirate Bay, every single episode.

maybe it means coming up with alternate ways to monetize

We have alternate ways to monetize. The simplest being doing exactly what they are doing except not DRM-ing their content, which demonstrably has worked for multiple content distributors. There are others.

DRM isn't about controlling content or monetize that content. It's about maintaining an outdated business model because business executives don't understand the internet. Which would be fine, except that it's hurting the open web.

mikeryan• 11 years ago

Orange is the New Black has, AFAIK, only ever been distributed through EME

This isn't even close to true. Netflix has a ton of non browser delivery mechanisms. It may only have been delivered with drm but that's a different thing and I don't know enough to know if that's true.

cwyers• 11 years ago

Is Netflix an outdated business model? Because it's not possible without DRM. Is any sort of video rental or subscription model outdated? And why is it outdated? DRM may not be able to provide 100% ironclad copy protection, but it provides roughly the same level of copy protection that video rental has before, probably better if you're comparing to VHS or DVD.

The idea that any sort of rental arrangement for video content is "outdated" reflects your own wishes, not the facts on the ground. The technology exists to provide good enough guarantees for the content providers, and it remains a popular choice with consumers. You're right that pirates have figured out how to break the DRM on Orange Is The New Black and distribute copies of it. What they haven't figured out is a new business model where consumers buy the majority of their content a la carte rather than getting much of it from subscriptions (Netflix/Hulu/Amazon type subscriptions or cable/satellite subscriptions) and rentals and theatrical exhibition.

orblivion3• 11 years ago

You keep telling that to yourself, and yet the businesses go out of their way to do something that you're so sure doesn't do them any good. Do you really think they're stupid? Do you really think they are wasting their energy, to support a system that possibly even hurts their bottom line? Are you in the entertainment industry? Do you know better?

I'm not saying they can't be stubborn. But I have a trouble believing that as outsiders we can really see all of the factors involved in these business decisions. Maybe there are different levels of sophistication from this camp, but I also remember people saying that piracy would actually help CD sales because it spread the word about artists. How many platinum records have there been in the last 5 years? I'm inclined to think there's something at play here, something that really hits their bottom line, that we're not considering. "Business people are stupid", while possible, is a hard line to swallow, they didn't get rich by being stupid.

Jack0002• 11 years ago

I kind of miss flash. Security issues aside, Actionscript 3 and the graphics api felt a lot easier to use than js/canvas and was more performant.

It felt like adobe just rolled over once Steve Jobs declared flash dead. They even bundled mcafee antivirus with the flash download, it's like they just want it to be over.

nsgi4• 11 years ago

Isn't it possible to create HTML5 apps with Flash Pro?

Jack0002• 11 years ago

in actionscript? I haven't worked with it for a while but I don't think so. Even if it was possible I wouldn't want yet another layer of abstraction to compile to html.

it's not the graphical authoring environment that really matters. I just prefer the OOP style of AS3 to Javascript.

Open standards are great and all, but the result is that we've had to wait years just for html to catch up to where flash was.

tree_of_item• 11 years ago

I think Haxe recreates the API method for method, and targets HTML5/Canvas as well as C++ and other stuff.

brandlib• 11 years ago

You can check out Adobe AIR; it uses Actionscript 3 and it deploys to web, desktop, Android, and iOS. In practice you can straight up copy-paste an AS3 codebase into an AIR project and have it work 99%. And I like to think that Adobe is more committed to supporting AIR since it's available for mobile.

murbard2• 11 years ago

Security is what matters here, the DRM can be circumvented anyway.

spiralpolitik• 11 years ago

To be honest the W3C was between a rock and hard place here as all the other alternatives on the table were worse than this. If they had dug in we would have ended up with 2-3 proprietary DRM standards across the browsers or Flash would have lived on. Both are worse outcomes.

As for "the open web", nothing changes. Content that was DRM free will continue to be DRM free, content that wasn't DRM free will still remain DRM. If anything we are slightly better off as one more proprietary has bitten the dust.

As with a lot of things, the next steps aren't technical. Organizations like the EFF should be working with content providers to educate them on the benefits of being DRM free. A much harder task than firing off press releases.

GhotiFish3• 11 years ago

If they had dug in we would have ended up with 2-3 proprietary DRM standards across the browsers or Flash would have lived on. Both are worse outcomes.

You're wrong about this. That is an excellent outcome. Large companies want the universal application that free software enjoys, but with none of the respect for the users it requires.

I have absolutely no problem with companies having huge problems locking users in. If we had 2 or 3 proprietary standards to implement DRM that things worse for users, that's a good thing.

"Why is this so hard to do?" The answer should be: "We refuse to make such abhorrent behavior easy", rather than: "It's not"

Making it easy for vendors to dick users over is a bad thing.

Making DRM easy to deploy damages the open web in a very bad way.

Tloewald• 11 years ago

Why don't the people with this point of view rail against proprietary fonts the way they do against video codecs? If we took the same approach to fonts then you'd only be allowed to use open source fonts and everything would look ugly. Instead we're allowed to deploy copy-protected fonts to render text nicely and no-one is unhappy.

If the ultimate issue is that people want to be able to steal video content with impunity, it all makes perfect sense. If the issue is technical or has to do with software freedom, I'm unconvinced. Not being able to open my old documents because Word 2025 isn't able to read Word 2004 documents is not the same thing as not being able to archive videos of Galavant that I don't have the right to keep.

GhotiFish3• 11 years ago

Oddly enough, fonts in particular have extreme benefits to open source models of development, the influence of actual research can be applied outright, and open fonts can be deployed rapidly.

I can't imagine a worse battleground to stake your argument on than this one, other than servers.

YouTube Ditches Flash, and It Hardly Matters

Related Stories