Hacker News Reader

I don't have any problems with the concept of DRM (controlling how a movie is used) but I have major issues with what is required to implement it. Essentially by definition you need to run some code that the user doesn't control on their computer. How Firefox does it isn't that bad because it is fairly well sandboxed but over time the urge will be to push it further up the stack so that gaining access to the content becomes more and more difficult.

I suspect give enough time they will push until they close the Analog Loophole.

It seems to me that the implementation issue is just a symptom of a deeper problem: copyright and DRM by definition grants a monopoly. This monopoly can be abused. For instance, if you want to watch movie X and it is distributed in such a way that you have to give private data, your options are not to watch it or get a "non official" version.

Could the copyright law be extend in order to prevent its abuse and protect the consumers, for instance by using the concept of "abusive clause" [0]?

[0] http://en.wikimediation.org/index.php?title=Abusive_clause

Edit: Once again, the DMCA rears it's ugly head. Time and again it seems to be the thing that is abused to screw over consumers. Maybe that's what we should actually be fighting against.

We should have prevented it in the first place, but given recent quasi-legal expansions centered around legal vagaries of it, I would completely agree we need to revamp and revisit laws relating to computing.

But the idea with EME was to create a standard interface to those CDMs. That way the entertainment companies can't be gatekeepers, as the CDM will work in any browser that implements EME, even your own that you made from scratch.

I'm not 100% clear on the technical side of this but according to the article, in order to implement the 'standard' you require permission from the entertainment companies as they control the CDM. So they're the gatekeepers. Is this incorrect?

Yes I think it works like this: publisher decides CDM, and EME describes a standard interface for all CDMs.

The trick, which EFF points out, is that CDMs are allowed to be blackboxes, and publishers can create their own and distribute them any way they see fit, which effectively lets them determine which browsers may consume their content.

But no matter what they can decide that already...

User agent checking (and other fingerprint checking systems), custom plugins which are required, or even going around the browser entirely and requiring a downloadable program or app to playback.

If the standard doesn't have EME, then alternatives will be made which will be much worse. EME is the best possible outcome in a world where DRM exists, and I would be just as happy as everyone else here if DRM was gone entirely, that just isn't going to happen any time soon.

Well, historically all those mechanisms have been problems for the open web. To me, the question is why you couldn't achieve the same thing without making the CDM a blackbox, e.g. just by issuing license keys and standardizing the encryption/decryption of content. It seems like the only benefit to making CDMs blackboxes is that it gives publishers more control over the user's environment.

Looking at that from a publishers perspective...

That locks me in to your encryption system, and probably locks me into other things as a result. That also doesn't give me the ability to enforce other DRM things like only one playback per device, or only allowing it to happen between 7am and 7pm, it also means that i need to trust the client, whih is exactly what DRM is trying to not do (because if the publishers could trust the client, an HTML flag for "don't let them save this" would suffice.)

DRM by nature basically needs to be a black box. This just standardized how that black box hooks into the system, and sandboxes it to limit what it can look at (and so we don't have a repeat of the Sony music issues)

We know that this is something the publisher's want. That doesn't mean CDM functionality can't be standardized. It doesn't need to be a black box, and you don't need to trust the client any more than you trust the user.

The point EFF is making is that its up to the W3C to maintain the balance between the power of publishers and the freedom of users.

EDIT: What I failed to realize is that unlike other content, in the case of DRM, publishers do not even trust the user.

https://news.ycombinator.com/item?id=11680863