Hacker News Reader

Comment by jasonmp85 | Hacker News Reader

What Netflix is doing that hurts the web is opposing net neutrality now that they're big enough they can bargain for special treatment.

This—on the other hand—provides a replacement for use cases which used poorly-supported, insecure, and battery-hungry proprietary plugins. I run Safari with no extensions and having this for Netflix and Amazon is fantastic. I trust Apple to patch security vulnerabilities and the browser is auto-updated along with the rest of my system. Not having to worry about Flash zero-days is more important to me than some purity argument about what the W3C should be doing.

If you seriously think VoD services were going to operate using standards without DRM in place I'm not sure you'll find many productive conversations on this topic. The web has been dead for some time and Netflix had very little to do with that.

View on HN

You're not getting EME extensions from Apple, you're getting them from the third-party that developed the extensions. You can count on terrible security vulnerabilities being found in these.

Movies aren't important. Netflix isn't important. The open web, the ideology (or as you put it pejoratively, "purity") behind it, is important.

So when an EME is installed open videos don't play anymore or something?

You don't need to Trojan-horse DRM into W3C standards to kill the web. Facebook Instant Articles, Google AMP, adtech, and general trends toward centralization are doing that just fine with no changes in standards whatsoever.

The amount of heat this change has generated is disproportionate to its actual role as a threat to the open web

What do you mean by "open web"?

From the beginning or near the beginning it was possible and not uncommon to put things on the web with restricted access. The HTTP protocol itself supports a couple of login mechanisms which were intended to be used to restrict access to content, and these have been there since at least as early as 1996.

Meaning anyone can implement the technology that can show a web page. You can't show Netflix's web page, unless they preapprove of your DRM.

And that's different from a web page that won't allow you to access it without a password, how? In both cases, a business decision by a third party limits what you're able to access.

I understand that you don't want to run code Netflix approves of and that you're not permitted to read in its original source form. And that's fine, a good reason not to subscribe to Netflix. But how is that any more an offense to "the open web" than a subscription-only website?

> And that's different from a web page that won't allow you to access it without a password, how?

It works the same regardless of what browser or OS you are using.

The point of EME is to minimize the amount of code that differs between platforms, by standardizing everything but (in essence) the authenticated key derivation step.

This is false. EME describes only the interface between the Javascript environment and the CDM. It says nothing about the CDM's interface with the browser code, which is the heart of the issue.

You're rebutting an argument I didn't make. The CDM is closed-source, but it was closed-source in the pre-EME world too. My argument is that EME opens up DRM stacks; it's that it opens up more of the DRM stack than was open before it.

> by standardizing everything but (in essence) the authenticated key derivation step.

Your argument is that EME covers most of the code responsible implementing DRM. This is false. EME is a small part. The large majority of the implementation is not standardized. For example, there is no equivalent of NPAPI in the post-EME world; the CDM/browser interface is browser-specific.

No, that's not my argument, as you can see from my comment above. What you've done here is twist my argument around to introduce claims I didn't make that you find easy to rebut.

> by standardizing everything but (in essence) the authenticated key derivation step

Is there another interpretation of 'everything' in this context? You're making EME far more comprehensive than it is. CDMs do way more than derive a key, so your statement is false on its face.

What is it you're saying CDMs do? Maybe we're just talking past each other.

The point of EME is to make it impossible for a browser to show a web page without having financial deals with the websites (or a 3rd party representing the websites).

That is what people oppose. The fact that you do not directly address this point and try to equivocate it to <input type=password> makes me question your good faith here.

What you're missing is that passwords don't require blobs. The ContentDecryptionModules used for DRM on the Web are blobs.

For a browser to run a blob, there needs to be an interface between the browser and the blob. Flash and Silverlight blobs used a standard interface: NPAPI. Any browser implementing NPAPI could run the blobs (assuming the blob was compatible with the host OS).

CDMs have no such standard browser/blob interface (note that EME relates only to the Javascript environment not the actual browser code). In fact, the only browsers able to run these blobs are the ones that the CDM provider 'trusts' and is willing to provide proprietary information to in order for browser developers to get their blob working. Your independent Firefox fork will almost certainly never be able to support any major CDM; the CDM provider doesn't trust, nor care about your browser.

Therefore, CDM providers arbitrarily _select_ which browsers can have access to their Web content. This is unprecedented. Content on the Web, in whatever form, has always been accessible by _any_ browser; it was merely a matter of that browser implementing the necessary standards. This is the idea of the open Web. CDMs are literally the opposite idea.

I don't think I'm missing it, so much as I'm not understanding what the material difference is between your unwillingness to run a blob on your machine versus your unwillingness to do any of the other things a business might require before issuing you a password.

You are free not to run those blobs, and not to use Netflix's services. Where you lose me is the militant demand that Netflix not offer services to those willing to run the blob.

You need to address this:

> This is the idea of the open Web. CDMs are literally the opposite idea.

Yes, both a CDM and passworded accounts limit access to content. The difference is that CDM providers are only letting certain Web browsers view the content. Passworded accounts have no such limitation.

The open Web is dependent on any conceivable browser being interoperable with ALL Web content. Any barriers to interoperability are only technical. Third-parties, like a CDM provider, cannot setup arbitrary barriers. Otherwise, it is no longer "open". THIS is the definition of 'open Web'; it has nothing to do with authorization as in subscription only websites.

EME strictly reduces the amount of "closed" code on the web. Without EME, more of the content protection stack is proprietary, and the trusted code base that enables content protection is larger. This is a very simple point that I think we all understand; I don't understand why EME's opposition thinks they can dodge it.

You need to address this:

> This is the idea of the open Web. CDMs are literally the opposite idea.

The assumption you make is that DRM _must_ exist in one form or another.

I, as an open web proponent, want to make it difficult for any business to add DRM to their media offering. by making DRM a difficult system to implement due to proprietary plugins, it increases the perceived value of just offering it without DRM.

but by having EME a standard, it makes it a no brainer to use DRM, because their customers will automatically have it as part of a browser. the cost of DRM is then externalised, and even legitimised such that it's the norm.

I have no trouble understanding the strategic goal nerds have of trying to use standards body formalities and browser vendors to retard the development of DRM software they disfavor. There's nothing wrong with that (at least, nothing more wrong with it than all the other things that are wrong with standards groups).

Where you lose me is the notion that there's an intrinsic ethical imperative not to provide attachment points in standards for DRM. That doesn't ring true.

Weird, the internet I know and love has plenty of issues with browser compatibility :-)

The OP is using the phrase "open web" in the standard way.

> If you seriously think VoD services were going to operate using standards without DRM in place I'm not sure you'll find many productive conversations on this topic.

I know you are completely right. But I'm still not happy about it and I will still complain about it.

The technical ineffectiveness of DRM isn't something that needs to be explained on HN, this is absolutely about business people and lawyers getting too much power without having the necessary technical understanding.

While I'm waiting for the solution on that, I'll continue watching torrented shows that are obviously Netflix screencaps.

Reply on news.ycombinator.com