Sure DRM is bad, but you can't tell people not to build things a priori like that, and DRM will be built because the content studios demand it, and the studios hold the content which everyone wants. The EFF greatly overestimates the amount of influence browser makers have. No amount of technical pressure will make an ounce of difference, because browser makers have literally no leverage on rights holders. If the streaming technology isn't available, then the studios will simply choose not to stream it, and whoever builds it first will have a huge market advantage.
Fighting EME not only is ineffectual, it harms open web standards by giving legs to completely proprietary solutions like Flash and Silverlight. The bottom line is that EME is a cleaner solution which compromises in a way that will make open standards more relevant going forward rather than taking an ideological position that will undermine the utility of open standards in the marketplace.
Instead of attempting to fight a self-harming losing battle, I wish the EFF would focus on the real problem which is the DMCA's overreach. Studios should feel free to build whatever DRM schemes they want, just like the people should be free to circumvent those measures for content they have legally purchased. Copyright law is sufficient to balance individual and studios' rights across a diversity of scenarios with getting a technical quagmire that benefits no one.
In other words, if I want to create a new browser, I then have to convince every single publisher whose content I want to display that they should add me to some list of approved providers. This does seem like it's just going to reenforce any initial power dynamics. I'm not sure what a better solution is though.
It essentially makes it harder for new competitors to emerge.
Which clearly cannot both be true at the same time. It isn't that it's impossible but there is actually some way to do it. It's just regular unadulterated impossible.
So why not give up the charade and publish the source code to the DRM? That can't cause it to be ineffective because it's already ineffective. It's not even a fig leaf, it's just security theater.
They meant that all they can do is delay the inevitable for some time by security-through-obscurity. And yes, the IP holders are perfectly aware of that, but preventing piracy even for a few weeks after release can have a measurable impact on their profits.
And it assumes that it currently takes weeks before new content makes it to torrent sites, which is not the case.
The first is that controlling the market for players isn't a legitimate purpose. You can't go to a court or Congress and say "we need DRM so we can monopolize and exercise market power in the market for DVD players and web browsers." It isn't supposed to do that, even if it does. So if the studios won't admit to that as its purpose then the people who want to get rid of DRM can easily win the argument against the lie they claim is its purpose. But if they do admit that its purpose is monopolization they also lose, because in that case it is effective but not legitimate. This is, incidentally, the reason why many suspect the reason we still have DRM has something to do with government corruption.
And the second problem is that controlling the market for players doesn't actually do them any good. It is the thing that causes them harm. Making the user experience worse is how you lose customers to piracy (and legitimate competitors).
And it gives power to people they don't want it to. If you buy $2000 worth of content on iTunes and the content providers demand that you re-purchase it if you switch platforms, that doesn't get you to re-purchase it, it gets you to not switch platforms. Which gives the platform providers more leverage over the content providers, because now they have captive users. If you're Fox or Paramount, you do not want your position with respect to Apple to be the one software developers have to the App Store.
DRM is a footgun. It's the opposite of "commoditize your complements." [1] We should get rid of it.
[1] http://www.joelonsoftware.com/articles/StrategyLetterV.html
Implementing EME in no way enables you to use these DRM technologies, so its a 100% worthless "standard".
The DRM/CDM modules are not browser agnostic either, and the browser <-> CDM api is entirely unspecified.
I don't know about other browsers, but at least Firefox is sandboxing EME modules so that they can only do a few approved things (security bugs aside, of course).
How the hell that is supposed to work if the CDM is oh-so-sandboxed is left as an exercise for the reader.
Did anyone actually check that own builds of vanilla Firefox sources are able to use the Adobe CDM? Wouldn't surprise me at all if it only worked with the official Mozilla-signed Windows binaries (yep, at least the Mozilla flavour of the "portable" and "interoperable" EME is provided for Windows and Windows only).
Reverse engineering or borrowing firefox's code might be technically possible, but that doesn't make it legal.
Integration between the video and the rest of the page is going to break without {video tag support with the necessary codec,flash,EME support with the necessary CDM}. Again, there is no difference.
You're trying to pretend that there is somehow a more usable page with EME+CDM over flash, when most of the time the video was the goal.
> having spent the last decade founding and building a premium content streaming service
You're fighting against the General Purpose Computer. Sorry, you don't get to run code on my computer without my approval. You don't get to turn my General Purpose Computer into an appliance. If you care at all about preserving any control over your own General Purpose Computers, stop. You've already spent a decade building the seeds of technology that lock down the web. Now John Deere has used the same ideas to take away property rights. You are adding difficulties to legitimate users while the pirates ignore your CDM and go straight to torrents/etc. Was the delusion that you're protecting anything worth these costs?
The rest of your comment is just straight up offensive zealotry. Spare me the ideological rants and go re-read my opening comment carefully. I spent the first 7 years fighting against DRM in direct conversation with rights holders. I have signed deals with hundreds of small distributors to stream content without DRM. I have done more for the cause of avoiding DRM in practice than a million EFF press releases which do nothing but preach to the choir. Furthermore, I am not building DRM, I am only implementing existing industry-standard DRM as required by studios. I can choose not to do so, in which case I won't get the content I need to build a viable business, and then I will go out of business, but the status quo will not have changed.
This nonsense about me forcing you to run code on your computer without your approval is asinine. I am not forcing you to run anything, run what you want, but I'm not allowed to stream certain content to you without it, that is beyond my control. If you only want unencumbered content, then don't use my service. This is not the same class of issue as nerfed hardware like John Deere. Like it or not, there is a legitimate reason for legal copyright which is inherently different from property rights, and conflating the two completely undermines any legitimate point which you might wish to make.
Sure, but it still relies a binary blob, just like Flash.
> ...I am only implementing existing industry-standard DRM as required by studios. I can choose not to do so, in which case I won't get the content I need to build a viable business, and then I will go out of business, but the status quo will not have changed.
Don't forget the story of how Apple forced the music industry into abandoning DRM on their "high-value intellectual property".
Had Google, Mozilla, Apple, and Microsoft all refused to play ball, and also continued to push towards the removal of Flash and Silverlight from the web, we would likely soon be seeing either the same abandonment of DRM'd streaming video, or the abandonment of streaming video by the major studios (and subsequent void filling by smaller players).
https://www.microsoft.com/en-us/store/apps/netflix/9wzdncrfj...
Dude, that's just not how you make friends and influence people. He knows all the arguments, he said it. Wouldn't it be more interesting to try to find with him a way we can all work together towards a better future, without attempting to shame the counterpart into a public admission of moral failure which will, of course, never happen?
That's why Linux has been successful: beyond the zealots, there were significant amounts of people (including Torvalds) who did not ask anyone to repent their proprietary sins before joining. "We build A, you build B, let's see if we can make something together which is a bit more like A, because we honestly think A is awesome, but hey, we like your B as well! It's just that we cannot help you if you keep it to yourself..."
The thing is, "we" are currently not building anything that might allay studios' fears. "We" don't even understand those fears, or choose to disregard them entirely. Of course they'll go out and do their own thing. If there was a safe way to deliver what they want (encrypted tamper-proof streaming) in an open-source package, they would likely consider it. But there isn't, afaik. Are "we" building it? No, we try to slut-shame "them" into giving up. That ain't gonna work, when there are billion of dollars and millions of jobs at risk.
The problem is fundamentally that "encrypted tamper-proof streaming" is not possible regardless of whether the implementation is open source. It would be trivial to write free software that respects copying restrictions. And then people would be able to bypass it using the same methods used when the copying restrictions are enforced by proprietary software, i.e. by writing different software that doesn't respect the copy restrictions.
> That ain't gonna work, when there are billion of dollars and millions of jobs at risk.
There is no risk to money or jobs. There is literally more Netflix content on torrent sites than there is on Netflix. Netflix nonetheless makes substantial profits.
Eliminating DRM would reduce piracy by improving the experience of legitimate purchasers without having any effect on the experience of people who download from torrent sites.
> Are "we" building it? No, we try to slut-shame "them" into giving up.
When you encounter someone who is demanding that everyone look for water using a divining rod, you don't build them a divining rod. You teach them that it isn't possible to find water that way.
In an absolute sense maybe not, but you can have decent approximations. As OP points out, music ended up being ok with watermarking. Hollywood might be ok with something like hardware tokens (which imho would be superior to "just download and execute this blob and shut up").
> There is no risk to money or jobs.
If that was the case, we wouldn't be hearing musicians crying foul about Spotify every other day.
> Eliminating DRM would reduce piracy by improving the experience of legitimate purchasers
At current prices, that's unlikely. The experience is not terrible with current players either; what drives privacy at this point is mostly price. Hollywood doesn't want to give up margins that are unrealistic in the digital age, which is why they fixate on DRM.
> When you encounter someone [...] You teach them that it isn't possible
There is teaching and there is shaming. Shouting at them that they are morally-corrupt buffoons is not "teaching".
No you can't. It's all inherently snake oil. The nature of the universe is such that if you can see something then you can copy it. Either you get people to respect copyright by believing in the social contract or you lose. There is no technological solution.
> As OP points out, music ended up being ok with watermarking.
Watermarking isn't DRM. (Though it shares a lot of the same failings in the sense that it reduces quality for legitimate purchasers and can be removed by pirates.)
> Hollywood might be ok with something like hardware tokens (which imho would be superior to "just download and execute this blob and shut up").
That kind of hardware is just software embedded in silicon. Any "hardware token" can be fully emulated in software as soon as you extract the keys out of it, which somebody is going to figure out how to do and then tell all their pirate friends how to do. By the time the hardware is in enough hands that you can require it to be used, it's already broken. And you can't patch silicon over the internet, so the pirates win for a decade. Then you come out with some new hardware that pirates have several years to break before it's in enough hands that you can require it again.
> If that was the case, we wouldn't be hearing musicians crying foul about Spotify every other day.
Spotify has DRM. Losing money to competition is not the same thing as losing money to piracy.
> At current prices, that's unlikely. The experience is not terrible with current players either; what drives privacy at this point is mostly price.
It's mostly not. A Netflix subscription is extremely affordable. The problem with it is that their app kind of sucks, and even that is rainbows and sunshine compared to the unmitigated horror of cable TV set top boxes. Movie companies should stick to making movies and leave the software to Canonical and Apple and Google.
> Hollywood doesn't want to give up margins that are unrealistic in the digital age, which is why they fixate on DRM.
Except that those two things have nothing to do with each other.
> There is teaching and there is shaming. Shouting at them that they are morally-corrupt buffoons is not "teaching".
That's because there are three different sets of people: The actual artists, the morally-corrupt buffoons, and legislators. Teaching is what the artists need. The others need something else.
And if you really don't even want to accidentally support or open such DRM content, you can configure the browser appropriately (media.eme.enabled and --disable-eme in Firefox).
> If you don't want DRM, don't watch media that requires DRM.
Well, obviously I don't.
> Nobody is making you use it.
The point is that there are fears that this could change once DRM is entrenched enough -- and getting into browsers is a Big Step along that road. (Hence the talk about changing General Purpose computers into appliances.)
I think general purpose computers and entertainment computers really need to be separate. Movies and AAA computer games cost a lot of money to produce, so I understand that the studios want to protect their investments with DRM. However, locked-down computers that users don't control themselves are fundamentally incompatible with a free society.
The only solution I can see for people to both preserve their freedom and enjoy some AAA content is to own 2 computers: 1 for AAA entertainment and another for everything else. Fortunately, computers are getting cheap and tiny.
The only reason the MAFIAA is lobbying the W3C and bribing Microsoft / Google / et al to support their backwards DRM is because the web has leverage over them.
There would have been no market for this if there was not publisher demand for baked-in proprietary DRM at the browser level, because they knew they were constantly losing revenue depending on broken flash / silverlight plugins.
If these companies had not caved to their demands, they would have had to accept gradual obsolescence since the web would have been wholly incompatible with their outdated business model. Because, up until this point, the web has been demonstrably more important to people than access to traditional big media IP, because they were losing revenue and market share.
Counterpoint: Flash and Silverlight, being "unclean solutions", are fundamentally hampered - the market split, and "HTML5" won (for now). The mere existence of a widely-accepted "clean solution" could easily do more harm than good.
And you greatly underestimate it. Look at the history of DRM in music.
Why do you believe the copyright holders (or the browser makers) are the ones who potentially hold absolute power in this scenario, rather than the users? Any DRM is an unsustainable system, EME is not going to change this. I also have strong doubts that EME will do anything to push the so-called "content industry" towards better sustainability as you suggest it will. There is still zero incentive for any knowledgeable user to buy into it. If anything it will just make the system more complicated because of the proliferation of even more competing, incompatible DRM systems that only work on certain devices with very specific configuration requirements.
I agree that some of the ridiculousness in the DMCA is part of the problem, but this isn't going to be solved by building more walled gardens, it's going to be solved by thinking about how it can actually benefit the user in the long run.
Agreed. Every implementation of DRM has been or will be broken eventually, and can keep people out of something that wasn't intended to be always locked.
Putting DRM on software and music is like building shitty locks into every book in the library or single in the record store. It doesn't make sense.
That's completely false. What would rights holders do if no browser supported their DRM extension? Stop streaming altogether? Browser makers just didn't want this fight because most of them have online streaming ventures of their own.
I am under the impression that the big content owners have renewed faith in winning the battles on the two fronts that matter to them: enforcing end-to-end controlled digital channels, from service to the consumer's own computer (DRM), and preventing the alternative of piracy.
They have learned that piracy cannot effectively be prevented by technical means, but that no longer matters if you can scare the vast majority of consumers with lawsuits and out of court settlements. This is now happening in a lot of economically strong countries.
First we have DRM video and soon after music.
Next the game industry wants to protect their source code. And app developers.
After that come images. A lot of companies would love to display their pictures but keep them from being "stolen".
And, at last, normal text will also be DRM'd and the open web is history.
I have heard that this is too high a hurdle. Why is that?
Without the Safe Harbor, people wouldn't be getting takedown notices or content ID - sites like YouTube, Reddit, Hacker News, comment boards, blogs... all would have been sued into oblivion years ago, as they would have been held liable for the content uploaded by their users.
Fixing the DMCA, then, requires a precise modification of the law, not just a straight up repeal - and getting that done without loosing ground in other areas would be a tough job for any lobby or politician.
Yes they do. They could implement a torrent client directly in the browser, and add a few torrent search engines to the standard search engines, so that searching and streaming a torrent becomes as easy as searching and streaming a youtube video.
But I think they will try to block it, because, reasons. And then we will end with an implementation for chrome, ie, opera and a plug-in for Firefox...
While I wait for that to happen or not, I'll continue not using Chrome, IE/Edge, or Netflix -- nor buying music or movies except in a form I can copy and distribute and play on local devices with no network and no proprietary or secret bits. EME existing or not doesn't affect me one bit.
If programmers actually used firefox and advocated it to the point where it had a majority market share then maybe their refusal would carry some weight.
But as it stands the web dev community has said loud and clear what their priorities are, and this is just a natural consequence of that.
The final straw was when they had a big update. Instead of fixing any of these issues, they gave me the ability to call people with service I don't use by clicking a link :/
I did spend a brief period swapping back to Firefox for the sake of perceived privacy, but then they started bundling all sorts of third party bloatware and it was just too much. I'm not a superfan of the information I imagine Google collects from my using Chrome, but the browser itself is just too good to give up. Firefox now only gets opened to verify cross-browser functionality of frontend UIs I work on, and on rare occasions when I want to use a proxy in a browser without it being used system-wide.
But then, I'm not a web developer
If you don't want to send information back to Google, don't use Chrome.
Use Chromium instead. It's Chrome, but without the spyware, and only has the open-source components.
It won't work for Netflix though, but for all your other browsing, it should work exactly the same as Chrome. Keep Chrome around for Netflix.
Browser can be either better technically, or you might have valency for certain design decisions.
If there is a browser vendors that claims certain social values, but is constantly failing to execute them in the design, you might as well just use the technically better one that does not pretend to protect the values you consider worth protecting. You will be spared of the constant disappointment.
Chrome was unbelievably quick: the moment you clicked on the launcher and browser 'chrome' (heh) appeared instantaneously, Firefox was comparatively sluggish, and notoriously memory hungry (though that might have been the fault of sloppily written plugins)
I wish browsers were more like uzbl, where the default were a simple browser and add-ons were like linux distros. You could have a firefox browser distro with a firefox branding and plugins to get great features but be able to remove them easily or strip it to its bare core.
We have the power, but sadly not the will.
1. Go to https://ftp.mozilla.org/pub/firefox/releases/
2. Click on the largest version number (46.0.1 right now)
3. Select "EME-free" under your OS
4. Select your language of choice
For the lazy:
https://ftp.mozilla.org/pub/firefox/releases/46.0.1/mac-EME-...
https://ftp.mozilla.org/pub/firefox/releases/46.0.1/win64-EM...
https://ftp.mozilla.org/pub/firefox/releases/46.0.1/linux-x8...
This makes a difference. You won't be able to watch EME-locked content, but every time you try, a content publisher will have to come up with the resources to send you the page with the locked content, all to no avail.
Of course, you'll probably either cancel your Netflix or find a workaround. But you won't be casually supporting EME on sites you never knew were using it. Your every day browsing will automatically block EME.
"The Net interprets censorship as damage and routes around it." - John Gilmore
Opt out of CDM playback, uninstall CDMs and stop all CDM downloads
You have the choice to globally opt out of HTML5 DRM playback. Once you opt out, Firefox will delete any downloaded CDMs from your hard drive, cease all future CDM downloads and disable DRM playback. This affects only DRM-controlled HTML5 audio and video. To opt out of HTML5 DRM playback completely, follow these steps:
Click the menu button and choose Options.
Click the Content panel.
Remove the check mark next to Play DRM content.In order to enable it, you must go to about:config and enable browser.eme.ui.enabled. While you are there, you can just disable media.eme.enabled and media.eme.apiVisible.
On Windows, it is shown indeed (45.1.1 ESR).
A perhaps easier approach that should work based on the name (but have not confirmed) is to lock via the user.js method user_pref/lockPref("media.eme.enabled", false). If this works as intended, then simply make this config file part of the deployment should be enough.
We don't like EME for technical reasons that the average consumer does not understand. Consumers will embrace EME because it connects them to content providers and not doing so would be like the linux users from over a decade ago who couldn't run flash.
Types of DRM that are bad magazines this is just my opinion, are eBooks, music, etc. that are purchased.
I donate a few times a year to EFF and FSF. I think there are occasions when DRM is OK, and even though I almost exclusively use Linux laptops (just converted my last Mac to Linux this week) other people using proprietary software does not much bother me.
I was the featured Creative Commoner many years ago, and I appreciate a world where Creative Commons licenses are used and mostly libre software is used, but while I can afford to release a book under CC, which I have done a few times, a movie studio that drops 100M making a film can not use CC.
Content producers have the right to rent their content. They just don't have the right to cripple the entire economy and everybody's infosec doing so.
Why? Genuine question.
DRM doesn't save new movies from piracy - new releases still hit the public torrent sites extremely quickly (sometimes before release).
And I don't understand what CC has to do with DRM. One is an intellectual property license, the other is a bucket of suck that categorically cannot work if users are to be allowed control their own machines.
Content providers see DRM as an implementation of a movie ticket system. You know, walls, doors and a doorman that kick you out after the movie is over. Also far from honour system.
And nothing should be "enforced" on user's device. It's user's, not anyone's else. Your analogy with the movie theater is invalid, because there you visit, and leave when it's finished. Here it's your private [digital] space, and no DRM junk should have any business violating your privacy for any kind of enforcement purposes.
I also don't get much of the argument of the EFF. A browser which doesn't support EME can't use sites which require EME, like Netflix. Maybe my English is bad or the text badly written.
W3C's biggest sponsors are corporate companies such as Google or Microsoft. It gives these companies a lot of weight.
I don't disagree with what you say, but it's possible to see EME as a pragmatic inevitability, assuming that browsers want to get rid of plugins (which seems like a good change) and assuming that content owners demand DRM (which makes less sense to tech-minded people).
Netflix didn't use Flash; it used Silverlight.
> don't disagree with what you say, but it's possible to see EME as a pragmatic inevitability, assuming that browsers want to get rid of plugins
Or browsers could just collectively get rid of plugins, and the media industry could whine ineffectually at the lack of DRM. They're not going to build their own browser, and people wouldn't use it if they did. Netflix wouldn't go away; millions of people would complain if it stopped working.
The Media industry would likely rally behind a platform that decided to play ball (like HBO Go), which would then implement some frankenstein DRM solution. "Get rid of plugins and the studios will adopt non-DRM solutions" seems about as useful as "Get rid of Limewire and people will stop pirating."
Hell they already do on just about every platform except desktop...
https://www.microsoft.com/en-us/store/apps/netflix/9wzdncrfj...
Second, many of the people running Windows 8/8.1/10 know so little about apps that they're "against" them.
Why not port it to Windows 7?
The advantage of building a Universal app using Windows Runtime is that it will run on Windows 8/8.1/10, Xbox One and Windows Phone. That's more than half a billion users....
They would have to start shipping their own proprietary apps to support their DRM, which is how things should have been. Browers could have gotten rid of plugins without DRM by forcing the old publishers to not be able to operate exclusively through web sites.
This isn't about the W3C.
This is about EME, and about the companies that created it and promoted it: Google, Microsoft and Netflix (as you can see on the spec, for example https://www.w3.org/TR/encrypted-media/ ).
Telling the W3C not to do DRM is not going to be effective. The only thing that can work is to put direct pressure on the parties behind EME, and their products: Google and Chrome, Microsoft and IE/Edge, and Netflix.
Not only is it not effective to focus on the W3C, it's counterproductive - it shifts the blame away from the real culprits just mentioned. If you lobby the W3C against EME but still use products from the companies that created EME, you're sending mixed messages at best.
Furthermore, even if somehow we got the W3C to not do EME, it wouldn't matter. Google, Microsoft and Netflix would still be implementing it. They would just find another standards body.