Really, the decision being made is between EME and Adobe Flash. Flash was the one cross-platform way to serve DRMed content before EME. And now that EME is ratified, Adobe, Microsoft, Google and Mozilla can all work together to get rid of Flash, and all the 0-days it has been responsible for, and improve security and battery life for everyone on the Internet. https://blog.chromium.org/2017/07/so-long-and-thanks-for-all...
Of course, we should also work to get rid of DRM -- it gets in the way of legitimate uses, and annoys legitimate users far more than it annoys pirates. But rather than vilifying Google and W3C and expecting them to be our saviors, instead we should be talking to Hollywood and Authors to adopt a DRM-free model just as many top musicians already have.
Disclaimer: I work at YouTube, and this is my personal opinion, not that of my employer.
W3C abandoning consensus (58.4%!) and open standards are biggest change in the organizations history. Its not just about DRM.
They would find another more hacky, less secure and less user-friendly solution, and everyone would be worse for it.
Lets be honest here. The argument being presented is that Netflix might create a new form of DRM without EME. We might get something worse then flash. There might even be a bad argument that Netflix and the content creator will abandon the market and millions in revenue if they can't get DRM.
A bunch of things that could happen, but not things that have happened. Flash have decline in used and Netflix was created in time before EME. To claim that EME was a requisite for those events is a logical impossibility.
Flash is a mix of dying and dead, mostly the latter. Having to use Flash is a strong economic and practical motivation not to use DRM, and if that wasn't the case there wouldn't be so much pressure to implement something in the browser itself.
Regardless of which of these occurs, you can bet that they wouldn't bother to sandbox the implementations, and we'd end up with the same security issues we had with Flash.
If browser vendors don't want to play ball (NPAPI is dying/dead, PPAPI and NativeClient are Chrome-only, etc.), then forget about in-browser video: they'd just build native apps instead. And maybe that's not a bad outcome for people who want the web to remain pure, but as a practical matter and a person who runs Linux, I like being able to run Netflix on my laptop.
I'm completely flabbergasted that people seem to believe that DRM would somehow magically disappear if the W3C hadn't been willing to discuss EME.
That sounds less like a technical problem and more like a threat to me. Because neither of those are actually technically necessary, except to support a business model that depends on some form of DRM.
Well, yes, that's absolutely true. But they have the leverage here (at least for now), whether we like it or not.
so why should _I_ have to install the un-auditable attack vector on _my_ machine?
you are well-positioned to understand this issue, so I'm baffled about how you can conclude this should be part of the default software suite in a browser.
Yes it is.
Suppose that in order to play DRMed content, the user was required to be staked to the ground and covered in angry fire ants. Nobody would be willing to do that, so people who use DRM would have no customers, so everyone would stop using DRM.
EME is in the opposite direction from this, so it will cause more DRM and less DRM-free content.
Adobe Flash has been slowly dying for years, which is not a problem.
In reality, all that will happen is that users will continue to be forced into using native applications where DRM can be enforced arbitrarily by whatever service they are trying to use.
That's the entire point.
All in all, average customers (as in, not the majority of the HN crowd) seem perfectly happy with the current experience. Even if they had to install a native app to watch Netflix on their laptop, I doubt that would change their perception much.
That seems to be the false dichotomy. The claim is that EME is justified in order to get rid of the oh-so-evil Adobe Flash. But if using native apps is a satisfactory alternative that can also replace Flash then why do we need to corrupt the web?
They (the general public AND 3DM, to TorrentFreak, bunch of whiners IMO) said Denuvo was the death of cracking and piracy. 3DM: No games crackable in 2 years time, said the headline.
now the cracking scene, which was mostly dying, has seen some revival.
It has adapted, but it's a slow moving ship.
Now a new generation (or the older generation, who knows, I'm just relaying my own observations)) are taking everything being thrown at them: encryption, virtualization, obfuscation, changing keys each patch, etc and making it look like light work to crack properly.
They make short, short work of it for the amount of complexity involved. So I hope they continue to throw new things at them with Denuvo, to keep them interested.
One group cracks the base game, sometimes someone else grabs all the updates and rolls them into a cracked patch, etc.
It's nice to see some life return to something that was basically dead, made automated.
Do you have a citation for this? Every game, dvd, stream, book etc ever has been cracked. Software protection has a 0% success rate.
In January 2016, 3DM reportedly nearly gave up attempting to crack Just Cause 3, which is protected with Denuvo, due to the difficulties associated with the process.[8] They also warned that due to the current trends in encryption technology, in two years' time, the cracking of video games may become impossible.[8][9]
[8] Owen S. Good (9 January 2016). "Piracy group nearly gives up on cracking Just Cause 3, warns of bleak future". http://www.polygon.com/2016/1/9/10741274/just-cause-3-crack-.... Retrieved 17 January 2016.
[9] Robert Purchese (8 January 2016). "Finally, tide turns in war with PC game crackers". http://www.eurogamer.net/articles/2016-01-08-denuvo-game-cra.... Retrieved 18 January 2016.
So, no evidence, only a feeling of evidence.
I personally would much rather have a secure, optimized and clean implementation, rather than hacky plugins and poorly developed solutions that put me at risk and destroy performance.
Media companies couldn't give any less fucks about the web. They can go 100 years without publishing on the web, since they have other revenue paths that they're perfectly happy with.
This whole process of enabling DRM is web developer's efforts to kiss media-companies ass in order for them to publish their products on the web. Artists and other creatives have the option to publish their works wherever they see fit. It's their creation, not the public's. In fact, there are actual art galleries that won't sell you their works if they don't deem you sufficient enough. How you exhibit their work matters to them. That's their right.
The web needs these media companies more than the media companies need the web.
Anyone that complains about DRM is doing it wrong. You are limiting the web because you are saying you don't want media companies to publish on the web. You are now causing the web to compete against media companies private apps or physical media, which is a losing proposition.
No one gives a shit about freedom. Everyone wants to use rights-managed content online. And the ONLY way to do that is with DRM.
So, yah, I'm not seeing any corruption here. Just acknowledgement of the fact that artists own their works, and web developers need to kiss their ass if they want artists to publish on the web.
When you hear about the multi-billion dollar fines and the immense amount of resources spent chasing down and punishing pirates, I have a hard time following this argument. I'd argue that the content owners and media companies need to get on board with providing the most seamless, easy to use, and accessible product for consuming their wares or this
> other revenue paths that they're perfectly happy with
won't continue to exist.
Right, and that's exactly what EME is. Because DRM-free content is a show-stopper for them right now, but they recognize that DRM is a pain point for customers.
Why should content owners post their products for free consumption? What is the incentive for them to do that? How much money do you think they will make?
In case you haven't noticed, the web is losing to apps at every level, from things like Facebook/Instagram/Snapchat to shopping apps. Even newsreaders are being turned into apps. My parents only use the Apple newsreader, for example.
Do normal people even use the web anymore? It seems the web is only used by tech developers.
Such a sad loss for the web..
What's the point of the web if it's just another crappy proprietary platform? EME is basically Flash 2.0.
>Such a sad loss for the web..
What loss? Is the only purpose of a software platform to devour everything without any integrity and it's worthless if it fails to adhere to the will of multibillion dollar companies?
That's a gross exaggeration; it's nothing of the sort.
Flash is a generic application framework that gets more or less unfettered access to the network, local machine, and browser state (Chrome's Pepper Flash improved a lot of this, fortunately). EME is a heavily-sandboxed decryption and display engine, and nothing more.
The Microsoft DRM implementation is built into Windows (and made available to Websites via EME) and requires cooperating device drivers or no highres video for you.
"Cooperating device drivers" isn't really the right way to look at it. The drivers themselves don't have any code that will refuse to play high-res video. The EME is just able to use the trust chain to validate that the output path hasn't been tampered with.
Any application can make use of TrustZone and the trusted output path; it's not something special only EME can access.
Right, which is why you might want to use it for handling key material or other sensitive things. Except you now have some gigantic DRM blob (the Widevine trustlet is huge compared to most saner ones) running in your "trusted" environment, able to access your actual sensitive data. That privilege should not be given out like candy (and generally isn't, except when DRM is involved).
> "Cooperating device drivers" isn't really the right way to look at it.
At least video vendors used to claim that DRM-related obligations prevent them from publishing specs for and/or open-sourcing those parts of their driver code that deal with video decoding/output.
> Any application can make use of TrustZone and the trusted output path; it's not something special only EME can access.
So, I've just finished writing my trustlet. How do I get it to load on common consumer devices? The ones I have all seem to require that I get it signed by the vendor which doesn't reply to my mails. How should I proceed?
This is pure bluster. As if they'd just walk away from one of the highest reach distribution platforms and all the money that comes with it just because they were denied a gaping vulnerability surface that provides no benefit for either them or the consumer. Sure, instead of learning the lesson from Spotify they'll just leave pirating as the #1 accessible and convenient method of getting content.
The media companies are coming to the web, DRM or no DRM, but of course it costs them nothing to bluff and claim they will take their ball and go unless they get all the special treatment they want.
No they can't. Physical media is going under. Newspapers and magazines are folding, music is primarily distributed digitally, even TV stations are treating the web as their primary means of content distribution. Media companies have no other revenue paths that will matter over a decade, much less a century, and most no longer have the money, resources or capabilities to do anything else.
>The web needs these media companies more than the media companies need the web.
The web is nothing but a network of networks. It wouldn't even blink if every big media company went bankrupt and took all of their content with them. The web would be a lot less interesting and a lot less fun, and make a lot less money, but it would still exist, and people would just keep distributing and pirating what they have.
Media companies, meanwhile, have bet their entire future on the web, and are only now realizing that it isn't the gravy train they thought it was.
> Just acknowledgement of the fact that artists own their works, and web developers need to kiss their ass if they want artists to publish on the web.
Whether or not artists own their works is orthogonal to the fact that digital content distribution has rendered their works nearly valueless, and opened a nearly infinite competitive market for similar work.
Rights are irrelevant. Morality is irrelevant. What the artists want or feel entitled to is irrelevant. The cultural significance of the corpus is irrelevant. Effective DRM is technically impossible and if that's what artists are depending on to survive in the digital age, then they will lose.
They can die like the dinosaurs, or adapt to the new order and become birds. But they cannot, ever, ever unstrike the meteor that is the web.
I'm not thrilled with DRM in the browser, but at least it's heavily sandboxed, and is way preferable to a series of native apps that get full access to my desktop.
What percentage of consumers exclusively consume media through apps, though?
Why? The web seemed to be doing perfectly well without them. Maybe the profit margins of concerns like Youtube and Netflix need them.
I accept your logic but disagree with your premise. Online media is the future, and any media company knows this.
Linux users could be a bit more screwed if publishers had to move to Windows/Mac apps if interested in desktop/laptop users, but otherwise it wouldn't be a big impact for the big properties.
What's the difference to a user of opening a Netflix app vs going there in the browser? Basically nothing.
Do we want apps on the web, or in the OS—that's the only question here. Browser vendors are incentivized to provide a path for apps in browser, because otherwise they become less relevant. And so this is the result.
(Personally I'd rather have OS-level native apps anyway. So please, kill DRM in the browser. Browsers are massive resource hogs. Netflix devs would probably be happy too to not have to deal with cross-browser-compatibility shit. The web is a mess already.)
There is not any kind of real difference between not having a native app (or whatever WINE patches are needed to run it) and not having some platform-specific EME black box binary.
> What's the difference to a user of opening a Netflix app vs going there in the browser? Basically nothing.
For Netflix? Basically nothing. For the other 99.9% of websites that aren't as big as Netflix? Users balk at installing apps from little known sources, so those websites then won't have DRM.
How many sites will be using this outside of stuff like Netflix/Amazon/PS Vue/Sling and co? Buying someone's DRM solution or building your own only makes sense for high-dollar content?
But again, from my perspective as someone who wants to write code for anything but browsers, anything that moves dev jobs away from the web is good news for me.
It's already supported both ways. Chrome on Linux can play Netflix, and before that there were third party packages that would install the Netflix app for Windows along with all of the patches necessary to make it run on Linux.
It should obviously also be possible to run the Netflix app for Android on Linux, as demonstrated by the fact that all the phones are doing it.
It doesn't really matter how hard it is to make it work, because for a high value target like Netflix, someone will make it work. And none of that will actually satisfy the free software people regardless, because it's a binary blob either way.
> How many sites will be using this outside of stuff like Netflix/Amazon/PS Vue/Sling and co? Buying someone's DRM solution or building your own only makes sense for high-dollar content?
How many sites used to use Flash?
You have to expect that somebody is going to produce a low dollar cost DRM system (which is correspondingly even more buggy and ineffective) and market it to managers who don't know any better.
That's kinda my point. Browser vendors had a no-win which-is-the-lesser evil choice: accept an in-browser binary blob but keep the linkability, etc, of the web, or concede the rest of the already-vastly-shrunken ground of the premium video playback market to off-web blobs.
Thing is, in ten years, it's not going to matter, because long-form premium video on web will be such a vanishingly small niche.
> How many sites used to use Flash?
For DRM instead of for ease of development and portability? Not many, I'd wager.
> Thing is, in ten years, it's not going to matter, because long-form premium video on web will be such a vanishingly small niche.
But that is the point. Why permanently infect the web and destroy trust in our institutions for the sake of something that it would barely hurt anything to just let go?
My claim is that the alternative isn't "more open" the alternative is "more closed, because the open web has yet another (this time self-inflicted) nail driven through it."
But I do think they're both lost causes, long-term. The open web will likely be increasingly relegated, for most users, to a dangerous place of viruses, malware, and shitty ads compared to their happy little walled gardens.
Not to play more-paranoid-than-you, but if you want to save the web, I think you've got to fix the web, first. DRM is a sideshow.
The "tech-savvy internet community" is the only place the W3C has any relevance. Nobody else has even heard of it. And destroying trust in something important among the only people who actually know what it is, that's a problem.
> and browser vendors are also looking at the millions more people who would see Netflix et al ceasing to function on the internet as just another reason to ignore the web as a whole?
The web isn't the internet and Netflix isn't the web -- it is an app, just like Windows Media Player is an app. The fact that you can also write that app in javascript doesn't change that.
Netflix doesn't work like the web. You can't create a hyperlink to a specific title on Netflix and send it to your friends or post it on Twitter. You can't embed a Netflix video in your own webpage. Just rendering an app in a browser isn't what makes it the web.
> My claim is that the alternative isn't "more open" the alternative is "more closed, because the open web has yet another (this time self-inflicted) nail driven through it."
You can't get more openness by making the open thing more closed. Even if more things then use it, then they're using the closed thing and you've gained nothing -- or lost something because previously-open things on the open web become more closed.
> The open web will likely be increasingly relegated, for most users, to a dangerous place of viruses, malware, and shitty ads compared to their happy little walled gardens.
The web is already a sandbox. Browsers are specifically designed to run potentially malicious code, and are very good at it -- the large majority of vulnerabilities (and super-spammy ads) come from terrible plugins like Flash, or soon the EME black boxes. It seems rather odd to argue that having those things makes the web better.
"Walled garden" means excluding native apps that haven't been sanctioned by the gatekeeper. It's a terrible system that gives too much control to the gatekeepers, but it only makes the web more competitive by comparison because you can still put whatever you want on your own webpage and not have to get it approved by anyone.
Do they? With the rise of the Mac App Store and whatever similar MS is doing, I doubt they much care.
If it was easy to install mobile apps direct from the author's website as on a desktop, who would voluntarily be paying app stores 30% of their revenue?
The developers (unfortunately) don't matter in this scenario. If the users want to install apps from the app store, that's what they'll do. Developers who don't list their app in the app store will increasingly find fewer downloads because their app isn't as discoverable as other, similar apps. I'd be surprised if this isn't already happening.
For your average user, only installing apps through an Apple-vetted install location is actually really great for security, especially considering the sandboxing that goes on. It just sucks that the developer loses out.
They discovered that the whole "You will come to us. We are the rulers of content" attitude was delusional.
Now they are falling over themselves to get back to the top, while kids watch idiots play video games on twitch.
And even my 60+ year old parents just stream torrents because no one can provide a better experience no matter how much you are willing to pay.
Ultimately, as long as the big content companies have content that people want to consume, they will have leverage. They want DRM, they will get DRM, or else they will take their content elsewhere, to alternative platforms that people will then flock to, making the web less relevant.
EME is the wrong hill to die on.
Media companies tried to ignore the web because it is the antithesis of their business model. The result was that the media companies became less relevant, because the web is better than cable TV, better than movie theaters, better than physical discs. We could and should have ignored EME and forced media companies to adapt or die, just like all those other outdated industries.
Media companies are not special cupcakes, they are just businesses and like any other business they have to contend with disruptive new technologies. Nobody shed a tear when the film processing industry faded away; nobody suggested that digital cameras should be restricted for Kodak's benefit. Why are we acting like Hollywood deserves such special treatment?
Forgive me not really giving a hoot.
> Media companies couldn't give any less fucks about the web. They can go 100 years without > publishing on the web, since they have other revenue paths that they're perfectly happy with.
Thus explaining their interest in the web, up to and including their push to lock it all down to prop up their outdated business model. If they are happy to stick with other sources of revenue they should do so.
> The web needs these media companies more than the media companies need the web.
Is that so? Funny how the web was already popular before media companies tried to get in on the action.
> You are limiting the web because you are saying you don't want media companies to publish on the web.
That's a strawman. Nobody is saying media companies should not publish on the web. We are saying that the thing that made the web valuable in the first place is openness, to which DRM is antithetical. Media companies are welcome to use the open system that is the web if they want to, and like the rest of us they will have to put up with certain trade-offs -- or at least that was the situation prior to EME.
> Everyone wants to use rights-managed content online.
I seriously doubt that the majority of web users -- billions of people -- care about rights management. The evidence seems to suggest that the overwhelming majority of users could not care less about copyrights, let alone the expansive "rights" that DRM is enforcing. People seem to ignore those "rights" at their convenience; in fact, people seem to seek the entertainment they want without regard to any "rights."
In fact, your beloved media companies also seem to not care terribly much about rights. The rights that copyright confers do not apply solely to copyright owners; included in copyright is the notion of the public domain and of fair use. Those rights are routinely ignored by media companies, through their lawsuits, their takedown notices (dancing baby), and their DRM systems which never include provisions for copyrights expiring and works entering the public domain. So other than yourself I am not sure ANYONE wants "rights-management."
Moreover, people have learned to love an entirely new kind of video entertainment: homemade, amateur videos of cats and other pets; of random people expressing their views; of dashcams in Russia; of idiots doing stupid things; etc. etc. In other words, while media companies were working hard to break the openness of the web, people were embracing that openness to create new forms of entertainment that the media companies could never have created on their own. Oh, yeah, it turns out the websites where those sort of videos are shared are the most popular video streaming services in the world and that more people (in the world generally) are watching videos on those sites than there are people watching cable TV.
So much for the all-important media companies.
> Just acknowledgement of the fact that artists own their works
We have evidence of artists dating back hundreds of thousands of years. Copyright and the notion that ideas and artistic expression can be owned only dates back to the 18th century and was just the final stage of European society adapting to a new communication technology (printing presses). We now have a new communication technology (computer networks) and society is adapting to the new rules and realities of that technology. Some ideas about art and artists rights are going to die, but in their place we will have new ideas and new rights. It is already happening, although in all likelihood none of us will be alive to see what society ultimately settles on.
So basically, the "fact" you are acknowledging barely rises to the level of a footnote in the history of artistic expression, one that is already fading into history as the Internet eats the remaining legacy communication systems. Sorry if that is a hard pill to swallow.
LOL. With what? Their paper? Their DVDs? Their CDs? Their cable channel subscribers?
Most of them already have pretty nice mobile apps; writing a decent native desktop app or three wouldn't stretch their capabilities at all.
if they want DRM, let them convince their own customers; just leave it off my machine.
On the other side, I can point to many websites that removed Flash/Silverlight/other security nightmare plugins after implementing EME.
The argument that some companies will avoid things their customers hate seems illogical, but you'll believe me if I provide an anecdote?
> On the other side, I can point to many websites that removed Flash/Silverlight/other security nightmare plugins after implementing EME.
Which is irrelevant because it has had a long known solution: Only install terrible plugins in a virtual machine, or if you're paranoid on a separate physical machine (a used PC capable of playing HD video is <$50), and only use that machine for that purpose.
And yes, that is an inconvenience, which is a feature, because DRM should be as inconvenient as possible. So that fewer people will use it.
> Which is irrelevant because it has had a long known solution
Your "solution" is not a solution for 99.99% of web users, and it isn't a solution for the remaining .01% who have to deal with botnets created from the other 99.99%.
The less customers like something, the less willing a company will be to sign a contract obligating them to do it.
> Your "solution" is not a solution for 99.99% of web users
One device used only for watching media is called a television and something like 99.99% of Americans actually have one already.
the cost should be born by the company who wants it, not the public.
why is this a bad thing for anybody but a content producer? and if it's not anybody else, then... why do we care? we have already legislated away the right to copy something in return for promoting creation. but the creation is going to happen one way or the other, so we need to go much further than the EFF advocates: we need to scale back copyright drastically.
it would have virtually zero cost to the public, and would not meaningfully affect creative output.
They have a lot of pull among a huge number of sites that depend on ad revenue.
Start buying this argument.
If I can compile it out, or get a version that someone I trust has compiled with it removed, that only leaves the rest of the web as a botnet attack surface.
That's what changes. Or doesn't improve, depending on how one views the timeline.
You can. https://www.google.com/amp/s/techcrunch.com/2015/05/12/mozil...
> that only leaves the rest of the web as a botnet attack surface.
1. Every new feature added to the web platform increases the attack surface of the browser, so this concern is not unique to EME. In this case, it removed a reason somebody would otherwise install Flash, which has a significantly larger attack surface.
2. All the major web browsers implemented EME before it became a standard, so the standardization of EME does not change anything here.
Your average web user has no idea what those words mean, and all they care about is being able to consume content unimpeded. They can't tell how it's implemented. Your decentralized web is not user friendly, and it will not gain mainstream adoption until it is.
With so much money involved here, it's quite naive to believe the W3C members are virgins here and did this out love for the web and for the consumers.
And:
"It is clear that the W3C allowing DRM technologies to be developed at the W3C is just a naked ploy for the W3C to get more (paying) member companies to join"[0]
0 - https://blog.whatwg.org/drm-and-web-security