Hacker News Reader

I think I agree with you, but the EFF raises some good questions. If content producers have this kind of control, how do you ever create a new browser? And can users really choose their browser if the major publishers have that much control?

In other words, if I want to create a new browser, I then have to convince every single publisher whose content I want to display that they should add me to some list of approved providers. This does seem like it's just going to reenforce any initial power dynamics. I'm not sure what a better solution is though.

I believe this is also reason why Google, Microsoft, Netflix all support EME.

It essentially makes it harder for new competitors to emerge.

That would be consistent, and relates to the main question I have: Why does the CDM need to be a blackbox? Couldn't the decryption be standardized with all proprietary information boiling down to secret license keys?

The CDM depends on whole-pipe proprietary implementation. You cannot implement, say, a video decoding library that is both open source and prevents the user from rerouting the video output away from HDCP HDMI sinks.

Because what they want to achieve is fundamentally impossible, and have to be done in a security-through-obscurity way.

> Because what they want to achieve is fundamentally impossible, and have to be done in a security-through-obscurity way.

Which clearly cannot both be true at the same time. It isn't that it's impossible but there is actually some way to do it. It's just regular unadulterated impossible.

So why not give up the charade and publish the source code to the DRM? That can't cause it to be ineffective because it's already ineffective. It's not even a fig leaf, it's just security theater.

> Which clearly cannot both be true at the same time.

They meant that all they can do is delay the inevitable for some time by security-through-obscurity. And yes, the IP holders are perfectly aware of that, but preventing piracy even for a few weeks after release can have a measurable impact on their profits.

If that argument was supposed to mean anything then DRM would only be required in the first few weeks after release.

And it assumes that it currently takes weeks before new content makes it to torrent sites, which is not the case.

Years ago, Ian Hickson wrote a perfect analysis of why we have DRM. It's as relevant as ever, and anyone should read it.

https://plus.google.com/+IanHickson/posts/iPmatxBYuj2

Now we're getting somewhere. But there are still a couple of problems.

The first is that controlling the market for players isn't a legitimate purpose. You can't go to a court or Congress and say "we need DRM so we can monopolize and exercise market power in the market for DVD players and web browsers." It isn't supposed to do that, even if it does. So if the studios won't admit to that as its purpose then the people who want to get rid of DRM can easily win the argument against the lie they claim is its purpose. But if they do admit that its purpose is monopolization they also lose, because in that case it is effective but not legitimate. This is, incidentally, the reason why many suspect the reason we still have DRM has something to do with government corruption.

And the second problem is that controlling the market for players doesn't actually do them any good. It is the thing that causes them harm. Making the user experience worse is how you lose customers to piracy (and legitimate competitors).

And it gives power to people they don't want it to. If you buy $2000 worth of content on iTunes and the content providers demand that you re-purchase it if you switch platforms, that doesn't get you to re-purchase it, it gets you to not switch platforms. Which gives the platform providers more leverage over the content providers, because now they have captive users. If you're Fox or Paramount, you do not want your position with respect to Apple to be the one software developers have to the App Store.

DRM is a footgun. It's the opposite of "commoditize your complements." [1] We should get rid of it.

[1] http://www.joelonsoftware.com/articles/StrategyLetterV.html

EME is not even a complete standard, its basically just a shim to bridge in a closed source DRM module that can do arbitrary things on the host platform, and needs specific DRM module support from providers. You cant just target EME as Netflix, or some other streaming site, you have to target Google Widevine, or Apple Fairplay etc.

Implementing EME in no way enables you to use these DRM technologies, so its a 100% worthless "standard".

The DRM/CDM modules are not browser agnostic either, and the browser <-> CDM api is entirely unspecified.

Yes, having spent the last decade founding and building a premium content streaming service I am well aware of what EME is and how the CDMs work. It is infinitely preferable to a proprietary plugin.

How? It is totally inoperable without a proprietary plugin backing it up.

Because everything else happening on the page is still regular web stuff, not encapsulated in a proprietary plugin like Flash. Essentially much smaller surface area of proprietary stuff, and because each browser only implements one CDM and they are responsible for the integration it doesn't break as much the way that Flash increasingly did over time.

If I go to a page with a video on it that uses flash, the rest of the page works just fine if I don't have the flash plugin installed. This is identical behavior to not having the CDM. If the rest of the page also uses flash, that's entirely separate. It is even possible that the rest of the page could be flash, while playing a video with either the native <video> tag or through a CDM.

Integration between the video and the rest of the page is going to break without {video tag support with the necessary codec,flash,EME support with the necessary CDM}. Again, there is no difference.

You're trying to pretend that there is somehow a more usable page with EME+CDM over flash, when most of the time the video was the goal.

> having spent the last decade founding and building a premium content streaming service

You're fighting against the General Purpose Computer. Sorry, you don't get to run code on my computer without my approval. You don't get to turn my General Purpose Computer into an appliance. If you care at all about preserving any control over your own General Purpose Computers, stop. You've already spent a decade building the seeds of technology that lock down the web. Now John Deere has used the same ideas to take away property rights. You are adding difficulties to legitimate users while the pirates ignore your CDM and go straight to torrents/etc. Was the delusion that you're protecting anything worth these costs?

I grant you that the point is largely video, and I probably made a poor choice to reference other things happening on the page, but even within purely the video playback, a CDM is hands down far less proprietary code than a plugin like Flash which not only is poorly optimized for any given browser, but also introduces a whole host of other issues which a CDM doesn't get anywhere near (eg. flash cookies).

The rest of your comment is just straight up offensive zealotry. Spare me the ideological rants and go re-read my opening comment carefully. I spent the first 7 years fighting against DRM in direct conversation with rights holders. I have signed deals with hundreds of small distributors to stream content without DRM. I have done more for the cause of avoiding DRM in practice than a million EFF press releases which do nothing but preach to the choir. Furthermore, I am not building DRM, I am only implementing existing industry-standard DRM as required by studios. I can choose not to do so, in which case I won't get the content I need to build a viable business, and then I will go out of business, but the status quo will not have changed.

This nonsense about me forcing you to run code on your computer without your approval is asinine. I am not forcing you to run anything, run what you want, but I'm not allowed to stream certain content to you without it, that is beyond my control. If you only want unencumbered content, then don't use my service. This is not the same class of issue as nerfed hardware like John Deere. Like it or not, there is a legitimate reason for legal copyright which is inherently different from property rights, and conflating the two completely undermines any legitimate point which you might wish to make.

> ...a CDM is hands down far less proprietary code than a plugin like Flash

Sure, but it still relies a binary blob, just like Flash.

> ...I am only implementing existing industry-standard DRM as required by studios. I can choose not to do so, in which case I won't get the content I need to build a viable business, and then I will go out of business, but the status quo will not have changed.

Don't forget the story of how Apple forced the music industry into abandoning DRM on their "high-value intellectual property".

Had Google, Mozilla, Apple, and Microsoft all refused to play ball, and also continued to push towards the removal of Flash and Silverlight from the web, we would likely soon be seeing either the same abandonment of DRM'd streaming video, or the abandonment of streaming video by the major studios (and subsequent void filling by smaller players).

Streaming services would most likely move to native desktop applications, like they do with mobile apps, before abandoning DRM. Netflix already has a Windows desktop application, but they don't seem to promote it much.

https://www.microsoft.com/en-us/store/apps/netflix/9wzdncrfj...

> Was the delusion that you're protecting anything worth

Dude, that's just not how you make friends and influence people. He knows all the arguments, he said it. Wouldn't it be more interesting to try to find with him a way we can all work together towards a better future, without attempting to shame the counterpart into a public admission of moral failure which will, of course, never happen?

That's why Linux has been successful: beyond the zealots, there were significant amounts of people (including Torvalds) who did not ask anyone to repent their proprietary sins before joining. "We build A, you build B, let's see if we can make something together which is a bit more like A, because we honestly think A is awesome, but hey, we like your B as well! It's just that we cannot help you if you keep it to yourself..."

The thing is, "we" are currently not building anything that might allay studios' fears. "We" don't even understand those fears, or choose to disregard them entirely. Of course they'll go out and do their own thing. If there was a safe way to deliver what they want (encrypted tamper-proof streaming) in an open-source package, they would likely consider it. But there isn't, afaik. Are "we" building it? No, we try to slut-shame "them" into giving up. That ain't gonna work, when there are billion of dollars and millions of jobs at risk.

> If there was a safe way to deliver what they want (encrypted tamper-proof streaming) in an open-source package, they would likely consider it. But there isn't, afaik.

The problem is fundamentally that "encrypted tamper-proof streaming" is not possible regardless of whether the implementation is open source. It would be trivial to write free software that respects copying restrictions. And then people would be able to bypass it using the same methods used when the copying restrictions are enforced by proprietary software, i.e. by writing different software that doesn't respect the copy restrictions.

> That ain't gonna work, when there are billion of dollars and millions of jobs at risk.

There is no risk to money or jobs. There is literally more Netflix content on torrent sites than there is on Netflix. Netflix nonetheless makes substantial profits.

Eliminating DRM would reduce piracy by improving the experience of legitimate purchasers without having any effect on the experience of people who download from torrent sites.

> Are "we" building it? No, we try to slut-shame "them" into giving up.

When you encounter someone who is demanding that everyone look for water using a divining rod, you don't build them a divining rod. You teach them that it isn't possible to find water that way.

> The problem is fundamentally that "encrypted tamper-proof streaming" is not possible

In an absolute sense maybe not, but you can have decent approximations. As OP points out, music ended up being ok with watermarking. Hollywood might be ok with something like hardware tokens (which imho would be superior to "just download and execute this blob and shut up").

> There is no risk to money or jobs.

If that was the case, we wouldn't be hearing musicians crying foul about Spotify every other day.

> Eliminating DRM would reduce piracy by improving the experience of legitimate purchasers

At current prices, that's unlikely. The experience is not terrible with current players either; what drives privacy at this point is mostly price. Hollywood doesn't want to give up margins that are unrealistic in the digital age, which is why they fixate on DRM.

> When you encounter someone [...] You teach them that it isn't possible

There is teaching and there is shaming. Shouting at them that they are morally-corrupt buffoons is not "teaching".

> In an absolute sense maybe not, but you can have decent approximations.

No you can't. It's all inherently snake oil. The nature of the universe is such that if you can see something then you can copy it. Either you get people to respect copyright by believing in the social contract or you lose. There is no technological solution.

> As OP points out, music ended up being ok with watermarking.

Watermarking isn't DRM. (Though it shares a lot of the same failings in the sense that it reduces quality for legitimate purchasers and can be removed by pirates.)

> Hollywood might be ok with something like hardware tokens (which imho would be superior to "just download and execute this blob and shut up").

That kind of hardware is just software embedded in silicon. Any "hardware token" can be fully emulated in software as soon as you extract the keys out of it, which somebody is going to figure out how to do and then tell all their pirate friends how to do. By the time the hardware is in enough hands that you can require it to be used, it's already broken. And you can't patch silicon over the internet, so the pirates win for a decade. Then you come out with some new hardware that pirates have several years to break before it's in enough hands that you can require it again.

> If that was the case, we wouldn't be hearing musicians crying foul about Spotify every other day.

Spotify has DRM. Losing money to competition is not the same thing as losing money to piracy.

> At current prices, that's unlikely. The experience is not terrible with current players either; what drives privacy at this point is mostly price.

It's mostly not. A Netflix subscription is extremely affordable. The problem with it is that their app kind of sucks, and even that is rainbows and sunshine compared to the unmitigated horror of cable TV set top boxes. Movie companies should stick to making movies and leave the software to Canonical and Apple and Google.

> Hollywood doesn't want to give up margins that are unrealistic in the digital age, which is why they fixate on DRM.

Except that those two things have nothing to do with each other.

> There is teaching and there is shaming. Shouting at them that they are morally-corrupt buffoons is not "teaching".

That's because there are three different sets of people: The actual artists, the morally-corrupt buffoons, and legislators. Teaching is what the artists need. The others need something else.

slut-shame? Is that a good analogy?

If you don't want DRM, don't watch media that requires DRM. Nobody is making you use it. It's something you use because want to use Netflix, etc.

And that would be why I don't use Netflix.

Exactly. What I have found is that when I examine deeply enough, most DRM content is not even worth it, and even for purely entertainment purposes, there exist plenty of non DRM solutions: movie theaters, libraries, outdoor activities to name just a few. I found Michael Niedermayer's quote very nice in this regard: "Breaking DRM is a little like attempting to break through a door even though the window is wide open and the only thing in the house is a bunch of things you dont want and which you would get tomorrow for free anyway" (https://ffmpeg.org/pipermail/ffmpeg-devel/2016-January/18824...).

And if you really don't even want to accidentally support or open such DRM content, you can configure the browser appropriately (media.eme.enabled and --disable-eme in Firefox).

This is exactly what I do, I disable EME in all browsers I use first thing after installing. Anything that is DRMed is not worth my time.

(Not PP.)

> If you don't want DRM, don't watch media that requires DRM.

Well, obviously I don't.

> Nobody is making you use it.

The point is that there are fears that this could change once DRM is entrenched enough -- and getting into browsers is a Big Step along that road. (Hence the talk about changing General Purpose computers into appliances.)

Yes, perhaps in the future, movie and computer game studios will lobby hardware manufacturers like Intel, AMD and ARM for locked-down hardware (non-free BIOS etc.) in order to protect their DRM.

I think general purpose computers and entertainment computers really need to be separate. Movies and AAA computer games cost a lot of money to produce, so I understand that the studios want to protect their investments with DRM. However, locked-down computers that users don't control themselves are fundamentally incompatible with a free society.

The only solution I can see for people to both preserve their freedom and enjoy some AAA content is to own 2 computers: 1 for AAA entertainment and another for everything else. Fortunately, computers are getting cheap and tiny.

I was working for Mozilla when EME first came up, and sat in one of the big sessions at that year's Mozilla Summit about it. Wrote up some thoughts here:

http://www.b-list.org/weblog/2013/oct/16/eme/

closed source DRM module that can do arbitrary things on the host platform

I don't know about other browsers, but at least Firefox is sandboxing EME modules so that they can only do a few approved things (security bugs aside, of course).

Perhaps the new browsers can implement the Firfox interfaces and install the same proprietary modules if they are so inclined.

Not legally because of the DMCA anti circumvention clauses, as the post points out.

Reverse engineering or borrowing firefox's code might be technically possible, but that doesn't make it legal.

Back then, Mozilla's plan was for the CDM to inspect the running Firefox and deny playback if it detects tampering of the relevant browser parts.

How the hell that is supposed to work if the CDM is oh-so-sandboxed is left as an exercise for the reader.

Did anyone actually check that own builds of vanilla Firefox sources are able to use the Adobe CDM? Wouldn't surprise me at all if it only worked with the official Mozilla-signed Windows binaries (yep, at least the Mozilla flavour of the "portable" and "interoperable" EME is provided for Windows and Windows only).

> The EFF greatly overestimates the amount of influence browser makers have.

The only reason the MAFIAA is lobbying the W3C and bribing Microsoft / Google / et al to support their backwards DRM is because the web has leverage over them.

There would have been no market for this if there was not publisher demand for baked-in proprietary DRM at the browser level, because they knew they were constantly losing revenue depending on broken flash / silverlight plugins.

If these companies had not caved to their demands, they would have had to accept gradual obsolescence since the web would have been wholly incompatible with their outdated business model. Because, up until this point, the web has been demonstrably more important to people than access to traditional big media IP, because they were losing revenue and market share.

>Fighting EME not only is ineffectual, it harms open web standards by giving legs to completely proprietary solutions like Flash and Silverlight. The bottom line is that EME is a cleaner solution which compromises in a way that will make open standards more relevant going forward rather than taking an ideological position that will undermine the utility of open standards in the marketplace.

Counterpoint: Flash and Silverlight, being "unclean solutions", are fundamentally hampered - the market split, and "HTML5" won (for now). The mere existence of a widely-accepted "clean solution" could easily do more harm than good.

> The EFF greatly overestimates the amount of influence browser makers have.

And you greatly underestimate it. Look at the history of DRM in music.

Apple made highly successful hardware, players named iPods. Apple effectively controlled what most users put on these players. The music industry had to consider it. And getting rid of DRM there took many years.

>DRM will be built because the content studios demand it, and the studios hold the content which everyone wants

Why do you believe the copyright holders (or the browser makers) are the ones who potentially hold absolute power in this scenario, rather than the users? Any DRM is an unsustainable system, EME is not going to change this. I also have strong doubts that EME will do anything to push the so-called "content industry" towards better sustainability as you suggest it will. There is still zero incentive for any knowledgeable user to buy into it. If anything it will just make the system more complicated because of the proliferation of even more competing, incompatible DRM systems that only work on certain devices with very specific configuration requirements.

I agree that some of the ridiculousness in the DMCA is part of the problem, but this isn't going to be solved by building more walled gardens, it's going to be solved by thinking about how it can actually benefit the user in the long run.

> Any DRM is an unsustainable system

Agreed. Every implementation of DRM has been or will be broken eventually, and can keep people out of something that wasn't intended to be always locked.

Putting DRM on software and music is like building shitty locks into every book in the library or single in the record store. It doesn't make sense.

> No amount of technical pressure will make an ounce of difference, because browser makers have literally no leverage on rights holders. I

That's completely false. What would rights holders do if no browser supported their DRM extension? Stop streaming altogether? Browser makers just didn't want this fight because most of them have online streaming ventures of their own.

What's the endgame? Free OSes "banned" from the "open web"?

Not from the open web, but excluded from participating in parts of the web economy and content.

I am under the impression that the big content owners have renewed faith in winning the battles on the two fronts that matter to them: enforcing end-to-end controlled digital channels, from service to the consumer's own computer (DRM), and preventing the alternative of piracy.

They have learned that piracy cannot effectively be prevented by technical means, but that no longer matters if you can scare the vast majority of consumers with lawsuits and out of court settlements. This is now happening in a lot of economically strong countries.

I think this poses a real threat to the open web itself.

First we have DRM video and soon after music.

Next the game industry wants to protect their source code. And app developers.

After that come images. A lot of companies would love to display their pictures but keep them from being "stolen".

And, at last, normal text will also be DRM'd and the open web is history.

Instead of attempting to fight a self-harming losing battle, I wish the EFF would focus on the real problem which is the DMCA's overreach.

I have heard that this is too high a hurdle. Why is that?

Because, for all of its sins, the DMCA provides one very crucial piece of legislation, without which the web as we know it would crumble: Safe Harbor.

Without the Safe Harbor, people wouldn't be getting takedown notices or content ID - sites like YouTube, Reddit, Hacker News, comment boards, blogs... all would have been sued into oblivion years ago, as they would have been held liable for the content uploaded by their users.

Fixing the DMCA, then, requires a precise modification of the law, not just a straight up repeal - and getting that done without loosing ground in other areas would be a tough job for any lobby or politician.

"browser makers have literally no leverage on rights holders."

Yes they do. They could implement a torrent client directly in the browser, and add a few torrent search engines to the standard search engines, so that searching and streaming a torrent becomes as easy as searching and streaming a youtube video.

Exactly, I think you can't win versus a drm movement. The only thing you can do is make the thing as open, public, regulated and planned as possible.

But I think they will try to block it, because, reasons. And then we will end with an implementation for chrome, ie, opera and a plug-in for Firefox...