Tim Berners-Lee envisions a better web
wired.com
wired.com
Something like Snapchat that provides a very very weak guarantee of privacy but has your classmates is immensely more useful to society than a decentralized federated social network with PGP signed identities filled with crypto enthusiasts.
The problem is not the principled nature of decentralized networks, but that they have to overcome the same hurdles as centralized networks—how do you compete with Facebook when they're so entrenched?
I'm not so sure. In my experience with encrypted chat apps with non-technical people, they completely ignore any kind of security in the key exchange. They'll give you their account number to get in touch but nothing to verify the key.
I don't see this changing in the near future or at all if fundamentals of public key systems aren't going to be a part of school curricula. I'm a bit sad that it's so poorly understood as public key cryptography has really changed the world in the past few decades (can you imagine going back to a world without online banking?). The key insight to understand is that cryptography can't establish trust, only maintain it.
The reason the web is broken is because it's a meeting point for the social, commercial, corporate, personal, academic, and political worlds. All of those worlds have different demands and requirements.
You can't fix a political problem by applying technology to it. There's a persistent myth that you can, but the reality is that publicly accessible technology mirrors the publicly accessible political environment, not vice versa.
Politically, neither ordinary users nor academic experts have the leverage to enforce the kind of secure, safe, trustworthy web most of us here would want.
Banks, corporations, governments, and the letter agencies do, which is why they have an effective monopoly on the practical applications of key security.
A minority of geeks and security specialists get some crumbs from the key exchange table, but they're a long way from being able to force strong security into the popular web.
I have a hard time taking him seriously at this point, he talks about User control while at the same time advocating for the Advancement of DRM in HTML5 standard
I can not square these positions, DRM is anti-user. You can not be for User control while also supporting DRM. Pick one
You don't, I don't, most others here not, but in general, they just want their movie. And they will use other technology, if the web does not provide what they want.
So for the html5 to stay relevant, it sadly has to contain it. Even though we can do without.
On a micro level, surveys show most people are extremely anti-free speech. Individuals are broadly onboard with the extreme and and anti-constitutional suppression of speech that runs counter to their political / religious beliefs.
And yet on a macro level, we tend to recognize in how we build our institutions that we strive toward a society that doesn't suppress speech.
Same with DRM. Just because everyone might say "Uh, fine, just start playing Moana already" doesn't mean we collectively would prefer the macro results of ubiquitous DRM.
False.
>they just want their movie.
That is the correct statement, Most "users" do not know what DRM so they can not "want it" as you claim
What they want is for their technology to work. DRM inhibits this.
Gaming is an example where users actively are agaist DRM, because in gaming DRM often punishes paying customers
BluRay is another example where Paying Legit Customers are punished as BluRay has a way to effectively brick BluRay players via their DRM update methodology
Users do not want DRM, they want the content they desire on the Platform/Service they desire.
>>So for the html5 to stay relevant, it sadly has to contain it.
False Again. Netflix and Google has Achieved what Microsoft Dreamed of in the Browser wars of the 90's
Vendor Lockin. No longer is HTML5 a open standard for all, in order to make a HTML5 browser for your platform that plays Video you must now beg Adobe, Microsoft or Google for Permission to use their proprietary bits.
W3C has violated their Core mission statement, as such they are no longer relevant at all, they serve no purpose now.
We need a New WHATWG, W3C is cancer
Most gamers use Steam, not WebGL, and the internet hasn't fallen apart.
People can survive using Roku/FireTV/AppleTV/PS4/XB3/standalone PC app for their streaming movie services. And if Google and Mozilla would allow people to keep installing third-party plugins like Flash, then they could do that to watch Netflix inside their browser.
If you become your enemy to defeat him, then you've already lost whatever it was you were fighting for.
There's good reasons to kill plugins: their security policies are almost always weaker than browsers and many security attacks on browsers and networks have used them. EME, even in plugin form, is in many ways better in this regard, as you can put it in sandboxes with fewer privileges.
I really don't believe that without EME, Netflix would abandon their web client. They'd just keep using Flash, which I am fine with, since I don't use their web player anyway.
But of course, Google wants EME, so naturally they're going to push for forcing out Flash.
> EME, even in plugin form, is in many ways better in this regard, as you can put it in sandboxes with fewer privileges.
I can't imagine anything you could sandbox in EME that you couldn't sandbox in an external plugin system designed accordingly. EME itself are plugins. Just don't ship them with the browser and enabled by default. That would do a lot to stop the smaller sites from trying to use EME on their content.
Furthermore, EME brings in the DMCA, and the W3C won't make any strong claims about requiring researchers to be able to publish vulnerabilities.
AIUI, the larger reason for wanting EME is to kill Flash and other plugins.
> I can't imagine anything you could sandbox in EME that you couldn't sandbox in an external plugin system designed accordingly. EME itself are plugins. Just don't ship them with the browser and enabled by default. That would do a lot to stop the smaller sites from trying to use EME on their content.
Flash needs access to many, many more OS-level features than any EME plugin does, as a result of its functionality being a superset of any EME plugin (okay, theoretically an EME plugin could use them all, but there's no evidence of any trying to do so). An EME plugin doesn't: need access to any web cam/microphone (or other devices), unrestricted filesystem access, etc. All of those are things that Flash can do.
Flash not shipping by default didn't exactly stop smaller sites from relying on it, though; once a small number of big sites rely on it and it has the installed userbase it's a relatively weak argument.
> Furthermore, EME brings in the DMCA, and the W3C won't make any strong claims about requiring researchers to be able to publish vulnerabilities.
Oh, I'm not claiming EME is good, but I think it's worthwhile understanding its benefits relative to the historic status quo if you want to argue against it. (I also have concerns about only worrying about the DMCA: other jurisdictions have similar laws around DRM and I don't think we should allow only those in the US to do security work on browsers.)
EME is also a plugin. Specifically, it's the Widevine plugin.
Only now it's installed by default on everyone's systems. And Chrome is already playing games and moving the setting from chrome://plugins to being buried under chrome://settings/content.
That "it runs everywhere by default" will mean even smaller websites will start using it to strip user freedoms.
Read the comments here: https://bugs.chromium.org/p/chromium/issues/detail?id=675596
Website owners are chomping at the bit to stop people from being able to save offline content.
> Flash needs access to many, many more OS-level features than any EME plugin does
Then make EME plugins optional, and don't ship them by default with browsers, and don't make them officially part of the HTML5 spec. Just because something is 'inevitable' doesn't mean you have to embrace it, if it's a fundamentally bad thing. This is usually referred to as 'having principles.'
> Flash not shipping by default didn't exactly stop smaller sites from relying on it, though
But it has resulted in many sites using HTML5 video. Especially when Apple decided not to ship it on iOS.
And right now, I can right-click and save those videos to my hard drive, which is just lovely for taking videos on the go with me.
> People can survive using Roku/FireTV/AppleTV/PS4/XB3/standalone PC app for their streaming movie services.
I don't understand the analogy, or what you're proposing here.
Steam is a pile of proprietary code, full of DRM. AppleTV/XB/PS/etc are all proprietary binaries, equally full of ad-hoc DRM.
So yes, the internet hasn't fallen apart because of this; companies found ways to deliver what users want, using their own closed and proprietary standards. The only thing in common here is the use of IP as a transport mechanism; everything else is a pile of proprietary crap.
This means no modifications, no reverse engineering, no using this in an unauthorized device, etc.
For the so-called "web", there are basically three options:
1) don't include anything in the standard, and let companies figure out individually how to deliver what users want, while still complying with their policies, and eventually reinventing the horrible experiences we had in the past [1]
2) embrace the app-ification of the web, with browsers becoming renderers of proprietary binaries -- just like the examples you mentioned: iOS, Android-based devices (FireTV, Roku), XB3, PS4, etc. With mobile driving the majority of the traffic, and WebAssembly as an emerging standard, one may argue that this is already here.
or
3) take the red pill, embrace that DRM as a necessary evil, and at least create a reasonably unified experience for users, getting companies to play nicely in the sandbox and reducing the risk of shenanigans [2]
From everything I read so far, Tim's effort is to avoid #1 and #2 from becoming reality. He's not in favor of DRM; he's against the "web" getting reduced to a pile of proprietary code running over IP and using HTML5 (internally) as the markup language.
[1] http://boingboing.net/2008/09/26/walmart-shutting-dow.html
[2] https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...
Exactly. And it's not on the web. DRM can survive off the web. We can keep the web open. Or at least, we could have, until Tim Berners Lee et al sold us out.
I have no interest in helping media companies implement a ubiquitous, single-solution DRM. Especially not at the cost of the open web.
> he's against the "web" getting reduced to a pile of proprietary code running over IP and using HTML5 (internally) as the markup language.
EME is the same effect. A pile of proprietary, closed-source, DMCA-protected code that without which you couldn't play your videos. It doesn't matter which piece you consider greater: addition is commutative. HTML5+DRM == DRM+HTML5.
I doubt Tim likes drm; I believe he views standardization as a greater good than exclusion from the protocol.
(Note: As I understand it, "Tim" is how he prefers to be called; I don't know him)
So long as they continue to think in terms of data and delivery the best they can hope for is Facebook plus privacy. They can do better than this.
Authentication, transfer of data, and all that look very similar.