Hacker News Reader

The fear is that this makes it far too easy to use DRM for webpage owners. Previously, you had to pull in a slow-ass Flash-plugin or similar, which was very much known to bring all kinds of security issues.

Now you just say "DRM this" and it does it, and you have the security issues whether you use DRM or not.

As a result, webpage owners might start DRMing things that were previously just not worth DRMing. Like images, text.

If you want to cite a news article in the future, you might have to type it off by hand instead of copy-pasting the part.

Also, just like DRM has done before, it's going to make content inaccessible for those who want to view that content at a later point with different technology, except that this time around it's not just going to be Netflix, it's going to be a good portion of the web.

So, yes, DRM has been part of the web for a long time, but how big that part is, is going to dramatically change.

> The fear is that this makes it far too easy to use DRM for webpage owners. Previously, you had to pull in a slow-ass Flash-plugin or similar, which was very much known to bring all kinds of security issues.

"Previously" in this case would have been four years ago, would it not? Ever since then, EME has already been reality. If EME has been reality and commonplace since then, what does this W3C decision really change?

> Now you just say "DRM this" and it does it, and you have the security issues whether you use DRM or not.

> As a result, webpage owners might start DRMing things that were previously just not worth DRMing. Like images, text.

> If you want to cite a news article in the future, you might have to type it off by hand instead of copy-pasting the part.

I would like to see some evidence for that. From a very brief read of what the EME spec defines, I don't believe this is technically possible in the spec. The spec only applies to 'protect' byte streams sent to audio and video codecs. If it were possible I think we would have seen implementations already since implementations have existed since 2013.

I hate DRM as much as the next guy, but we shouldn't need FUD to get that point across.

> "Previously" in this case would have been four years ago, would it not? Ever since then, EME has already been reality. If EME has been reality and commonplace since then, what does this W3C decision really change?

There is no FUD here. The W3C should not be involved in standardizing DRM API. If browsers want to implement DRM it is their problems. Everybody dropped the ball here. Mozilla, the W3C ... they could have just said no, that's not our problem, they were too corrupt to do that, they just signed the death of the open web.

I agree with most of what you say, except your first sentence.

The FUD here is that the implication is that now text and images will be DRM'ed. EME only allows DRM'ing video and audio. Facts matter, and making stuff up to 'support' the point does not help. His post literally starts with "the fear is..." and then provides no facts to support it.

It may be so that they signed the death of the open web. But it seems to me that if this is your definition of the death of the open web, the open web has been dead since the broad support and use of the <object> or <embed> tags with RealPlayer, Flash and Silverlight - and very dead since broad adoption of EME before the W3C had any standards on it. Signing that death after all this time does not add anything except for some symbolism.

You can DRM images with EME fairly easily: you just have a single frame video. And you can always take the Twitter approach with text and just render it into an image, which is then just a single frame video.

That said, the text option is not that realistic as long as there are legal obligations as regards accessibility, which will require the accessibility tree to contain a closed captioned version of the media (and that isn't encrypted).

Sure, everything can be hacked into a video on the web. But luckily that makes your web page unusable, unaccessible, and also un-SEO-able. It would also require you to have expensive DRM authoring tools to have you actually create DRM signatures (it's not just a switch you can flip on). Let me rephrase: EME can only be practically applied to actual audio and video.

The point still stands. EME has been commonplace for three years now. If the fear that it would grip beyond audio and video in the real world is based in reality, we would have seen it by now. The W3C decision changes nothing for the people who would use it.

Yep, but that's absolutely what's going to happen. People love to put square pegs in round holes. I'd be surprised if most things weren't DRMed within 5 years.

I don't buy it. People could DRM up the internet - including text and images - much more easily - for years with Flash and Silverlight. People could use the everything-is-a-DRMed-single-frame-video-now hack since 2014. Neither have been a problem. I've never even seen the latter happening, even as a proof of concept (although I suspect someone will point me to one shortly).

There will be absolutely no change. All major browsers already implement EME (this includes Edge, IE, Chrome, Safari, Firefox, Opera and a bunch of minor ones).

I personally think it is a step forward, as it is much better than Silverlight. Now all the client behaviour is out in the open, and only the DRM piece is proprietary.

There is no way that removing EME will make things better, that would just require all streaming services to build native clients or browser plugins, which isn't exactly improving any transparency.

People were naively thinking/hoping that once Flash and plugins die, DRM would magically disappear and media companies would start putting all their content on the open web, for anyone to access.

I'm with you, I'd much rather have a clean, secure and well implemented option, rather than each company trying to hack together a solution that will be buggy, insecure and inefficient.

The option of there being no DRM was realistically never on the table, as much as people would've liked it to be.

I wouldn't say that. If it between having no DRM and having no web presence, I think broadcasters would pick no DRM. DRM really doesn't do very much to protect against piracy. It's just a way for C-level execs to show they are doing something to protect their IP. It's a kind of security theater.

I think it's foolish to think that. Right now, if you wanted to share a video from HBO to your friend (assuming you couldn't give your account), what are your options. There's no easy way for you to just give that content to your friend. You'd have to link them to a third-party site hosting the content, which is not the same thing.

With no DRM, it would be as simple as doing a right-click and copy video link.

The recording industry was very hardline with DRM, until one day Apple decided they won't support DRM anymore in the iTunes Store. Thus no music is purchased with DRM from any of the major e-tailers.

If the choice is no DRM or literally not making any money on the Internet, content creators will choose no DRM every time. Technologists have all the leverage here. If the web simply didn't support DRM, do you think Netflix, Hulu, and NBCUniversal would pack their bags and lose on billions of dollars because of some theoretical increases in piracy? Of course not. They'd just offer their content with no DRM.

There are many file sharing, illicit streaming and torrent websites that have the entire HBO catalog available. They are pretty easy to find with simple Google searches. Piracy is not esoteric, it's pervasive even today. There is absolutely no technical obstacle to watching any HBO or major studio's content online for free. And that's arguably a lot easier then figuring out how to copy a huge file for non-technical users. DRM can't have any major effect here, people who want to pirate will pirate, DRM be damned.

The only thing DRM does is introduce barriers to legitimate interoperability and innovation. You get situations like "does this operating system or device support Netflix?" which is unheard if the web was truly an open system.

> The recording industry was very hardline with DRM, until one day Apple decided they won't support DRM anymore in the iTunes Store. Thus no music is purchased with DRM from any of the major e-tailers.

This is not comparable in my opinion. Music was bought, downloaded, stored locally and used on countless devices - from your living room setup, your NAS and media center, to portable players or your car. It made no sense to restrict that kind of content to specific software like iTunes.

A Netflix stream doesnt face the same problems. Compatibility isn't an issue here. Most consumers will never run into problems with Netflix' DRM.

That said, of course if it was possible to buy and download movies for permanent offline viewing, similar to music purchases, it would be absolutely necessary to provide that content DRM-free.

> That said, of course if it was possible to buy and download movies for permanent offline viewing, similar to music purchases

There's actually quite a few systems which do exactly that. Funnily enough, all use DRM.

I'm not talking about temporary offline access to Netflix movies or buying/renting a movie via iTunes. I meant purchasing a real video file that I can put on my NAS and view in a player of my choice. Similar to music. I'm not aware of any video services that offers that.

> buying a movie via iTunes, Amazon, etc

Why, precisely, do you think you can't play the video file in a player of your choice? That is literally what DRM is - technical restrictions against using content you have purchased in a manner you desire. They provide the file in an encrypted format that only their own player can decrypt.

When iTunes used DRM for music, only Apple's devices could play music you bought from iTunes, too.

I'm aware of that and have been criticizing the movie industry's requirement to ship content with DRM for a long time, particularly as an avid and frequent buyer of DRM-free, lossless music.

However you're right - the iTunes purchasing example shouldn't have been part of my previous response. On the other hand I think DRM is fine, if not a necessity, for a subscription service like Netflix. It is basically renting content and my expectations towards these services are very different from a store that offers purchasing, which should absolutely be a DRM-free experience. The fact that it's not is exactly the reason why I don't buy films on those platforms, unlike music, which is available countless large and niche stores.

> I'd much rather have a clean, secure and well implemented option, rather than each company trying to hack together a solution that will be buggy, insecure and inefficient.

So with EME vendors can still do this: "hack together a solution that will be buggy, insecure and inefficient"

EME just gives a basic API and a way to get this DRM stuff into the browser. This doesn't do what you think it does.

The compromise mentioned in the article would have only helped with making it more secure.

The option of there being no DRM was realistically never on the table, as much as people would've liked it to be.

Way back in the 2000s when HDTV was getting off the ground, the networks demanded that all recording devices support a "broadcast flag" that would allow them to prevent recording. CBS in particular said that unless this was legally mandated, they would refuse to broadcast in HD. Instead we called their bluff, and they backed down because it turns out they don't hate money: https://www.eff.org/deeplinks/2009/06/dtv-era-no-broadcast

Sure, media companies would prefer a world where everything is DRMed and all computing devices are locked down, and if we hand that to them on a silver platter they'll take it. But I don't believe for a second that they can't survive without it.

One great thing about the personal computer revolution and the World Wide Web is that, thanks to its open specs nature, pretty much anything can be part of the Internet. That doesn't mean everything should be part of the standards: EME requires a piece of software called the Content Decryption Module, which is developed for Hollywood by software companies like Microsoft and Adobe, and can not be open source. So basically what the W3C is saying here is that every standard complaint browsers should include a binary blob from a private company. And that is, by the way, what will change from today to tomorrow.

This goes completely against the nature of the Internet, and it's also useless (as it will not stop "piracy"). I can't believe the W3C is doing this, it's extremely sad and marks a dangerous precedent.

It's just another chip in our ability to own things. It just another way tha makes us more beholden to our digital landlords. This lawyer explains it best: http://www.newsweek.com/silicon-valley-private-property-and-...

In recent times pretty much all the DRM vehicles have been canned as native code browser extensions have become 'bad' for malicious code. So the DRM delivery mechanisms like java plugins, flash and so on are being taken out of the web and this standard sticks it back in. I have mixed feelings about this until I really dig into how the interface is supposed to work.

So it was almost out as part of the modern web stuff, and it came back the very next day.

As a follow up, isn't all this DRM for naught? If you send the video and the audio to my computer, I can record it after it's decrypted. What problem does this really solve? I already use netflix/amazon because it's more convenient than torrenting, unless it isn't. Seems the possibility is nil DRM-free versions of DRM content won't be available anyway.

You're right, content will always be pirated. However, security and rights management is never about definitive solutions. DRM makes it hard for 99% of the people and that's enough for copyright holders. They can focus their resources on the other 1% (unfortunately including poeple with legitimate reasons).

I'm not agreeing with this but it's how it is and I don't see that changing. I agree with another commenter that it's been like this for virtually forever and this decision doesn't change much.

> DRM makes it hard for 99% of the people

Does it though? I mean, there are already non-drm versions available, and have been "forever". Yet 99% of people still choose netflix because it's easier. Even the 1% choose netflix because it is easier.

How does restricting the delivery of legitimate/legal content impact the way that people consume illegitimate/illegal content?

I also don't see it changing, but it seems like it will have /obviously/ literally zero impact on the availability of pirated content, and how/if people use pirated content.

>DRM makes it hard for 99% of the people

I don't think this is true. You can find illegal streams for many (most? (all?)) TV shows with a quick Google search. It's also pretty common knowledge that TPB and similar torrent sites exist, and you don't have to be in the top 1% of computer users to install a BitTorrent client.

>You can find illegal streams for many (most? (all?)) TV shows with a quick Google search

Not in my experience. I couldn't even find a 2016 movie on the top torrent sites last week.

If all you watch is Game of Thrones and other globally popular shows, then yeah, I'm sure it's trivial.

DRM makes it hard for 99% of the people

IMO we have oversupply of interchangeably disposable content fighting for a limited number of clicks, if someone makes it hard for their customers to engage, they are shooting themselves in the foot. E.g. whenever I'm greeted with a paywall, that tab is instaclosed.

RealPlayer was not a Web Standard like EME is. This decision codifies DRM in Web rendering standards.

If DRM has already existed for years, and the majority of browsers have already accepted EME as a de facto standard by implementing it, wouldn't codifying that standard be positive?

It's like arguing that Flash is a standard because the majority of browsers supported it. DRM isn't the open web and should have nothing to do with the W3C. You want to force DRM onto your users? write a native app.

We could "solve" the entire ad-blocking "problem" by delivering DRM-protected web pages that cannot be modified by the end consumer, merely viewed. This would also "solve" the "problem" of scraping.

All that is needed now is a DRM format that delivers HTML/JavaScript and is implemented by Chrome, Safari, and maybe Edge.