Hacker News Reader

Comment by _phaq | Hacker News Reader

The fear is that this makes it far too easy to use DRM for webpage owners. Previously, you had to pull in a slow-ass Flash-plugin or similar, which was very much known to bring all kinds of security issues.

Now you just say "DRM this" and it does it, and you have the security issues whether you use DRM or not.

As a result, webpage owners might start DRMing things that were previously just not worth DRMing. Like images, text.

If you want to cite a news article in the future, you might have to type it off by hand instead of copy-pasting the part.

Also, just like DRM has done before, it's going to make content inaccessible for those who want to view that content at a later point with different technology, except that this time around it's not just going to be Netflix, it's going to be a good portion of the web.

So, yes, DRM has been part of the web for a long time, but how big that part is, is going to dramatically change.

View on HN

> The fear is that this makes it far too easy to use DRM for webpage owners. Previously, you had to pull in a slow-ass Flash-plugin or similar, which was very much known to bring all kinds of security issues.

"Previously" in this case would have been four years ago, would it not? Ever since then, EME has already been reality. If EME has been reality and commonplace since then, what does this W3C decision really change?

> Now you just say "DRM this" and it does it, and you have the security issues whether you use DRM or not.

> As a result, webpage owners might start DRMing things that were previously just not worth DRMing. Like images, text.

> If you want to cite a news article in the future, you might have to type it off by hand instead of copy-pasting the part.

I would like to see some evidence for that. From a very brief read of what the EME spec defines, I don't believe this is technically possible in the spec. The spec only applies to 'protect' byte streams sent to audio and video codecs. If it were possible I think we would have seen implementations already since implementations have existed since 2013.

I hate DRM as much as the next guy, but we shouldn't need FUD to get that point across.

> "Previously" in this case would have been four years ago, would it not? Ever since then, EME has already been reality. If EME has been reality and commonplace since then, what does this W3C decision really change?

There is no FUD here. The W3C should not be involved in standardizing DRM API. If browsers want to implement DRM it is their problems. Everybody dropped the ball here. Mozilla, the W3C ... they could have just said no, that's not our problem, they were too corrupt to do that, they just signed the death of the open web.

I agree with most of what you say, except your first sentence.

The FUD here is that the implication is that now text and images will be DRM'ed. EME only allows DRM'ing video and audio. Facts matter, and making stuff up to 'support' the point does not help. His post literally starts with "the fear is..." and then provides no facts to support it.

It may be so that they signed the death of the open web. But it seems to me that if this is your definition of the death of the open web, the open web has been dead since the broad support and use of the <object> or <embed> tags with RealPlayer, Flash and Silverlight - and very dead since broad adoption of EME before the W3C had any standards on it. Signing that death after all this time does not add anything except for some symbolism.

You can DRM images with EME fairly easily: you just have a single frame video. And you can always take the Twitter approach with text and just render it into an image, which is then just a single frame video.

That said, the text option is not that realistic as long as there are legal obligations as regards accessibility, which will require the accessibility tree to contain a closed captioned version of the media (and that isn't encrypted).

Sure, everything can be hacked into a video on the web. But luckily that makes your web page unusable, unaccessible, and also un-SEO-able. It would also require you to have expensive DRM authoring tools to have you actually create DRM signatures (it's not just a switch you can flip on). Let me rephrase: EME can only be practically applied to actual audio and video.

The point still stands. EME has been commonplace for three years now. If the fear that it would grip beyond audio and video in the real world is based in reality, we would have seen it by now. The W3C decision changes nothing for the people who would use it.

Yep, but that's absolutely what's going to happen. People love to put square pegs in round holes. I'd be surprised if most things weren't DRMed within 5 years.

I don't buy it. People could DRM up the internet - including text and images - much more easily - for years with Flash and Silverlight. People could use the everything-is-a-DRMed-single-frame-video-now hack since 2014. Neither have been a problem. I've never even seen the latter happening, even as a proof of concept (although I suspect someone will point me to one shortly).

Reply on news.ycombinator.com