given that in-stream ads still have blocking/ignoring methods I think that if this arms race keeps going that ultimately the data (video, whatever) is going to be stuffed behind some hard authentication barrier of some sort -- and then traditional piracy methods will take over like single-user-rebroadcast/etc.
In the end, if the only way to block the ads is to have a setup so complicated that only 1 in 10,000 people would be able and willing to maintain it, that’s basically perfect. The people who will spend hours and hours perfecting and maintaining their ad blocking setup were never going to buy premium anyway and they’re negligible drains on resources.
TBH baking it into the video stream is probably the easiest path. The whole video doesn't have to be re-encoded if the ad is spliced in. This is a "soft lockdown" since the ad can theoretically be manually skipped by the user, but its probably good enough.
A temporal URL here uses different random looking values for the each user rather than a fixed one (like a URL shorter), and encode a validity window (not before/after).
The core idea here being that the code in the app doesn’t know the difference between ads and user content, which would make it very difficult for any intermediary to do so. And, if if they did the URL for the “real” content wouldn’t work until the time to play the ad had passed - so what’d be the point in bothering?
Like others have said - ya just have to pay for the things you value. No shame in being thrifty, but as I learned from my first employer: pick great suppliers and never force them out of business.
I really hope that that would be enough to finally coax the antitrust regulators into doing something.
No, you can't adblock remote attestation. Trust me, the whole idea is cryptographically sound (with a proper implementation of course), people have been building out the remote attestation/TPM space for 20 years now.
Every time it's brought up (like I previously suggested that it could be used by NVIDIA/etc to disrupt mining operations from a driver level) there's people who think there is some easy runaround and if there was the whole idea would be broken from the start. The TPM provides a secure root to start the cryptographic validation from, and while you can mod the software, it will be immediately evident from the attestation, and they will simply not serve the video. Or in the case of a GPU, you can have the PC attest to the drivers being official and unmodified, and if that doesn't happen the GPU refuses to clock up the memory bus.
At best it will be an arms race between TPM developers and adblock devs.
There is also the "analog gap", but that's been notionally plugged for years using HDCP. Early implementations were quickly broken, HDCP 2.3 is still doing pretty well, and it provides a massive speedbump to people who think they're just going to plug a capture card in and loop the video through.
Netflix and others have been doing this for all the years and the tricks are well-known at this point. Netflix doesn't push too hard, but they won't serve you the highest-quality video if you don't have a secure signal path either.
Without a TEE (eg. trustzone), you're not going to get anything above 540p, at least with widevine. Note TEE is baked into the SoC itself, so while it's not impossible to find a bug, it's much harder than finding a exploit in android or system apps.