Hacker News Reader

Standardization provides endorsement. If DRM requires a non-standard plugin, and plugins themselves become increasingly verboten, at least some folks who might have used DRM may decide that they want to reach a wider audience instead.

Consider what happened when Apple refused to allow Flash on their platform; that certainly accelerated the decline of Flash, or at least forced the development of Apple-specific approaches for that platform.

So what would happen if Chrome and Firefox had stood together in solidarity and said "no"? I don't think the answer would have been a mass exodus to IE; for that matter, what if IE had gone along with it? (Edge already bans plugins.)

So what would happen if Chrome and Firefox had stood together in solidarity and said "no"?

Given that Google has been one of the biggest voices in favour of EME, that seems rather unlikely.

Yeah, the thing is that Chrome interests are inseparable from Youtube's, and unless they can force the media companies to let go of DRM, like Apple did to music labels, they need some kind of solution. And frankly, what's in it for them?

Apple uses DRM for subscription music, but not music you've paid for a perpetual license; why wouldn't Youtube use DRM (at the copyright owner's request) for music and video when you haven't paid them for a license?

Does youtube use DRM? All the youtube download extensions suggest not.

YouTube rentals and purchases use DRM (and the downloaders don't handle those); normal videos just use obfuscation.

DRM is obfuscation.

No DRM yet, but Google doesn't allow YouTube downloader extensions in their Chrome Web Store (but allows downloaders for other video sites, how strange :-/).

> If DRM requires a non-standard plugin, and plugins themselves become increasingly verboten

The unstated assumption here is that DRM that isn't a standard won't be built into a browser.

> The unstated assumption here is that DRM that isn't a standard won't be built into a browser.

That's not the assumption (because DRM already existed in the browser before it became a web standard - remember Silverlight?).

But it's much less work for the entities providing the DRM when EME provides a common standard for them to work with. This lowers the pain (for them) of using DRM, which makes it harder to provide enough pressure on them to stop DRM.

EME commoditizes DRM, for better or worse. Like you said, a EME lowers the pain to adopt DRM. With a standard EME API and CENC (Common Encryption), services can easily support multiple DRM backends or switch DRM backends. I worry that increased competition between DRM providers will lead to an arms race of stronger DRM tech.

It's worse than that. Competition drives price to zero. That means DRM providers need to get their revenue from some other way. The obvious way is to exploit (track, or worse) the user.

So if these businesses did earn money from DRM, you think they'd go "some extra profit by adding user tracking? Oh, no, thanks, we're good" and leave it on the table? Why?

Umm no

EME Standardized the Plugin err "extension" API. It in no way standardizes DRM. The Stardardization is around the way Javascript will be used to call inside HTML5 the browsers CDM (content decryption module" which is a plugin by another name.

There are currently 3 competing technologies, with more to come, that are incompatible with FOSS, incompatible with open systems

For Chrome Browsers there is Google Widevine CDM

For MS Browsers there is MS PlayReady

For Firefox there is Adobe Video CDM (which is basiclly the video playback part of Flash)

This is the problem with EME, Netflix, Google, and Microsoft have been masterful at their marketing of this to people that should be able to see past the bullshit

EME/CDM is still a binary browser plugin, Sure we "eliminate" flash and the need for a "3rd party" plugin, but in many ways that it worse, Before we had a standard Plugin API that allowed non-supported browser to make use of Flash, so there where many many many browser that could call the 3rd party flash application to make use of that content. Now those browsers are completely locked out. You will only be able to Access content on the Big 2, Chrome and IE, and maybe Firefox is they finalize their agreement with Adobe to bring in a Binary Blob into the Firefox Browser

I do not call that a "WIN" for interoperablity.

> Standardization provides endorsement.

Indeed. Standardizing an unethical practice sounds like a very bad idea.

>So what would happen if Chrome and Firefox had stood together in solidarity and said "no"? I don't think the answer would have been a mass exodus to IE; for that matter, what if IE had gone along with it? (Edge already bans plugins.)

Google has been a prime supporter of DRM on the web. They bought Widevine a few years ago which is a DRM provider and pushed for inclusion of DRM in the W3C.

It's basically Mozilla vs. the rest, just like it happened with patent encumbered H.264 and Mozilla was left holding the bag.

>those who want to use DRM are not going to accept any alternative that is not DRMd

This is patently false. From 2003 to 2009 music sold on the most popular online store, iTunes, contained DRM. Due to competitive pressure from Amazon's DRM-free store, Apple also dropped their DRM. It once seemed impossible that the major labels' digital music would be sold without DRM, but now that is the norm. Content industries can and have changed their minds on DRM when consumers force them to.

Content industries can and have changed their minds on DRM when consumers force them to.

However, it's also worth noting that the music industry is the only major content industry where this has been achieved.

If anything, things are going the other way with video content. There have been stories this week about Netflix cracking down on those who are circumventing region locking using VPNs. It seems big name shows are increasingly being offered via proprietary pay-per-view systems run by their production organisations, and centralised libraries like Netflix are either not carrying the material or dropping content they used to offer. We still have different release dates for movies in theatres in different countries, and for films and TV shows on DVD/Blu-ray. A recent trend seems to be for US TV shows not to release new seasons on Blu-ray at all here in the UK, so you can buy the lower quality version on DVD or you have to sign up for yet another online service to watch in HD, assuming you even have access to such a service from where you live. All of these measures are overtly consumer-hostile, but there is little the consumer who enjoys TV and movies can do if the entire industry moves that way (short of resorting to illegal channels and risking the consequences, which obviously is what a lot of people do in practice).

The software industry is similarly screwed up. We've gone from buying a copy of something and being able to use it, to buying a copy but needing remote activation, to buying a copy but needing varying degrees of ongoing online access to continue using it, to not even being able to buy a copy and merely renting. Personally I draw the line before I get that far, and refuse to pay for any important software unless I can reasonably expect it to continue working indefinitely. Even then, my businesses have been screwed repeatedly by varying degrees of ongoing online access or cutting off support, and slightly surprisingly, the most expensive professional software is by far the worst for this and for fixing the mess is something goes wrong.

I really hope that before too long the law starts to reflect the real relationships with modern technologies, where the original vendor who would traditionally be the main second party in a purchase contract is effectively just providing an introduction to the real other party, which is the organisation that makes the software/service and is (or isn't) going to provide ongoing support and/or retain ongoing control over it. I also hope that smaller, disruptive software businesses who are starting to take on industry heavyweights can demonstrate that money talks and enough customers are willing to vote with their wallets for less one-sided arrangements. But for now, the possibility that industry heavyweights like Microsoft, Adobe and Autodesk are going to give up their vice-like grips built on DRM and related technologies seems more remote than ever, and all of them are pushing hard in the opposite direction.

gog.com is an example of the software industry (or video games, at least) eschewing DRM on an ethical/consumer rights basis. They're highly successful, and may well pressure Steam and other similar markets to follow suit if their upward trend continues.

Good point, GOG is another modest success story for DRM-free content. That said, success is a relative scale here: even a hit like Witcher 3, where there is an obvious commercial association between GOG and the developers, only sold slightly more copies on GOG than on Steam, while most big name titles either aren't released on GOG at all or sell many times more through other channels like Steam. If we saw the likes of EA and Ubisoft backing off DRM for their new AAA titles instead of doubling down on it even in the face of some very obvious problems, it would mean a lot more in terms of industry direction.

Apple and Amazon managed to change the practices of the music industry because they had enough power. Netflix has started down the path of building more power, by having their own content. Perhaps when Netflix has enough power they can push back on the video industry.

At least in public, Netflix has claimed that they don't want DRM themselves, and would remove it if they could, but that their content providers require it.

Actually, I think the main reason that music went DRM free was to circumvent Apple's dominance. Since they had by far the most popular portable digital music platform, and wouldn't allow third party DRM on it, the music industry had a choice -- either deal with Apple, or forego DRM altogether.

That's basically what happened. Apple wanted to go DRM-free (see Steve Job's Thoughts on Music letter) and did so as soon as they were able according to their contracts. But before they did, the publishers offered DRM-free music to Amazon first allowing them a head start on Apple.

I think DRM is mostly forced upon Netflix by Hollywood. If Netflix didn't need to DRM every stream, they could reduce their hosting costs and network latency by pushing static video content to CDNs and caching servers. For example, Google hosts YouTube server appliances in ISPs to reduce latency.

While removing DRM would certainly help Netflix, it doesn't stop them from offering such edge boxes already; ISPs can already host a box on their network that supplies Netflix videos to that ISP's customers.

That's what they say, but the Netflix original content is still DRM'ed, last time I checked.

The dance doesn't match the music.

It's no surprise that music leads the way, video (and especially live video) next, and software after that - they are ordered here by complexity.

However, the anti-censorship instinct of the internet will eventually drive all of these forms media to an open distribution model.

Ebooks are still DRM'd in the major distribution networks, so I'm not sure the complexity model explains everything.

Hmmm, good point. Perhaps it's a partial explainer, and other factors like inertia, popularity, reach, etc. need to be factored.

In an echo of what derekp7 said above about the music industry turning to no-DRM as a way around Apple's restrictions on the iPhone, there are publishers who are turning to DRM-free sales of books directly to consumers to bypass Amazon's control of the Kindle ecosystem. O'Reilly and Packt come to mind immediately, but I'm not sure if it's a function of their audience or I just know of them because I'm in their audience.

EDIT: Which, to the larger point -- DRM is two things, a content play and a platform play. Standardizing DRM is one way to limit the power of platform holders over content providers. Eliminating DRM is another. Deciding whether standardizing DRM is a lesser evil than leaving DRM up to platform holders is a question of who do you fear more, the content owners or the platform owners.

> Standardizing DRM is one way to limit the power of platform holders over content providers.

Half the problem is EME doesn't even attempt to standardise DRM in any real way: it just provides a JS API to deal with DRM'd content, decrypted by some "module" which interfaces with the browser in an undefined way (and in every case except Firefox, does so by bundled with no possibility of any other modules being installed).

Tor has gone DRM-free for their e-books as well and Baen has been DRM-free from the start.

> However, it's also worth noting that the music industry is the only major content industry where this has been achieved.

Video games are a major industry where there was significant pushback from DRM thanks to sellers like GOG. There are still many games with DRM, but the portion that don't use DRM has increased significantly.

I'm personally very happy for GOG's success, but as I mentioned in response to 'Zikes, we do have to keep that in perspective here. Sadly, that "significant pushback" doesn't seem to stop certain big name game developers from pushing out new products that people will still pre-order by the zillion even though the launch of the previous title in the franchise fell over for days because the servers died or some such.

Except that the music industry has gone back to DRM. Most people I know consume their music using streaming services these days and I'm under the impression that e.g. Spotify are forced to use DRM by the content owners.

Apple didn't drop their DRM because of Amazon. They wanted to drop it before then, but the publishers in order to promote an alternative to iTunes made DRM-free music available to Amazon first. Apple dropped it as soon as they were allowed by the publishers. It was written into their contract that DRM was required. Steve Jobs talked about this in his "Thoughts on Music" post. It doesn't appear to be on Apple's site now (it was written in 2007), but you can read the whole thing at,

http://macdailynews.com/2007/02/06/apple_ceo_steve_jobs_post...

The relevant part is: "The third alternative is to abolish DRMs entirely. Imagine a world where every online store sells DRM-free music encoded in open licensable formats. In such a world, any player can play music purchased from any store, and any store can sell music which is playable on all players. This is clearly the best alternative for consumers, and Apple would embrace it in a heartbeat. If the big four music companies would license Apple their music without the requirement that it be protected with a DRM, we would switch to selling only DRM-free music on our iTunes store. Every iPod ever made will play this DRM-free music."

Note that W3C did not standardize DRM in a usable, interoperable form that you'd expect from a standard.

They merely accepted a JS API for launching non-standard proprietary DRM Content Decryption Modules. API of these modules is deliberately undefined and left to be browser-specific.

It's just as standard and interoperable as using W3C's <object> to launch Flash.

There are always people on the fence. I see this sort of attitude appear all over the place, from terrorism to suicide prevention and now DRM. People have already made up their minds, it's said, and they'll do what they've decided to do regardless.

It's just not true. Lots of people are pushed only weakly towards one side or the other. Making it easier to go one way and harder to go the other way will influence where people in the middle end up.

I think you underestimate inertia. Once encrypting JS is just a checkbox in your IDE, management and lazy developers will just check it.

Aha, so encrypted javascript is something new that I've not seen mentioned in any of these discussions!

However, does EME allow encryption of javascript? I thought it was just for playback elements in <video> and <audio>? Searching a bit, I can't find evidence that executable javascript could be encrypted.

I've seen proposals to allow EME to control access to any browser resource: images, fonts, scripts, even HTML itself. The proposals I've seen look a lot like Service Worker, but with an opaque obfuscated container running a blob.

Good news for unblockable adverts and ad-delivered malware! Running code that can't be inspected or blocked is really not a good idea.

That confirms what I wrote in bug 923950.

https://bugzilla.mozilla.org/show_bug.cgi?id=923590

AFAIK DRM servers are very expensive, although maybe once EME is mature we'll see DRMaaS that will sway more content providers to use DRM.

Azure Media Services Content Protection

> However, by not standardizing, we lock out all sorts of non-mainstream clients form accessing content. Now that Flash is going to disappear entirely, that means no access to all sorts of content on Linux, unless it's standardized.

Flash is only disappearing because of Web DRM. The situation gets worse for Linux users. Instead of installing the Flash plugin and seeing DRM content through it, now DRM only works if you are using Google Chrome because it's the only browser with Hollywood-approved DRM scheme.

As for users of FreeBSD and other less popular OSes, well Google Chrome doesn't have a build for you, so you lose this content completely.

Well, not really.

Netflix and such need Chrome to play videos because of DRM. Well, let me see: Netflix doesn't cache any videos, so if I want to watch something more than once, it's smarter to download it unencumbered.

And then it gets to the point that pirating most of your content makes sense again. If you're going to be a scofflaw, might as well go all the way, and get the good experience from it.

Standardization makes it easy and reliable. If those that insist on DRM need to navigate unreliable, mediocre technology, it requires more development effort and delivers a sub-par user experience, thus leaving the door open for DRM-free competitors.

No, because Google, Microsoft, and Apple could have coordinated on implementing EME even without an official W3C stamp of approval. Or they could have implemented 3 separate APIs for DRM. Netflix and others would be mildly inconvenienced, but that's something they could deal with. As long as content producers insist on DRM, which they do for video, the sub par user experience is going to be with the platforms that don't support Netflix.

Reminder that HTML5 started without an official W3C stamp of approval. (Hell, it started with the W3C membership voting against any further work on HTML, thus the formation of the WHATWG.)

>However, by not standardizing, we lock out all sorts of non-mainstream clients form accessing content. Now that Flash is going to disappear entirely, that means no access to all sorts of content on Linux, unless it's standardized.

That is simply not true. Flash was on the way out with or with out EME, Chrome and IE was already doing it. With out EME they still would have moved forward with their implementations of Widevine and PlayReady respectively.

Netflix would have still switch to it, and Chrome on Linux would have still played Netflix.

EME did not result in "Content coming to Linux" and there is no guarantee it will continue.

It will be up to the individual CDM makers, in this case google, if they want to continue to include the binary blob on Linux. No different than Flash. If google chooses tomorrow to remove widevine from Chrome on Linux, there goes your Netflix and any future "HTML5 EME" enabled websites

Further many other "HTML5" Browsers can not play this content because the binary blob required is not there... making it non-interoperable with any true FOSS gnu/linux operating system. Firefox has to pay Adobe for a CDM Plugin under pressure from their less than idealist users...

"HTML5" as a standard should mean anyone implementing the spec is able to see all content built on the spec. Sadly with the inclusion of EME sites like Netflix can claim to be "HTML5" compliant while still preventing every FOSS HTML5 browser from viewing any content.

That is not a WIN for Standardization, or a WIN for interoperablity

> My reasoning there is that those who want to use DRM are not going to accept any alternative that is not DRMd.

The way to deal with them is by not accepting them in return, and only using alternatives. Losing money bites, and they can quickly straighten their crooked ways out of fear for competition. That's the only method that works for curing DRM disease.

I think I mostly agree with you.

I think standards bodies operate most efficiently when they provide a bit of choice. If some browser writers want to implement DRM in their browsers I would rather it be standardized than not. Simply because the W3C doesn't standardize it does not mean it will not be implemented in browsers. It's not like W3C standards are binding legal documents.

From TFA: Much of the "Web" is disappearing into apps and into the big companies' walled gardens. If it is to be relevant in the decades to come, it must do everything it can to keep the Web open as an alternative to those walled gardens.

Then remove a reason for the web to disappear into walled gardens and allow the W3C to standardize DRM. Not providing ways for everyone to serve up their content via the web will only accelerate movement to other mediums.

I like the idea of the non-agression covenant. But the obvious problem with it is that implementers of EME don't have to sign it. It looks like it only covers those who participate at the W3C. It's a rather strange legal concept, and possibly unenforceable, but I'll leave it at that.

> My reasoning there is that those who want to use DRM are not going to accept any alternative that is not DRMd.

Of course they will. The big media companies like to posture and pretend they're going to take their ball and go home, but the customers hold all the power in this relationship. It's not like they are going to leave money on the table by sticking to dying platforms out of a religious devotion to DRM, they just think they can have their cake and eat it too by bluffing.