Perspectives on Encrypted Media Extension Reaching First Public Working Draft

Amazon distributes MP3s via "the open web" - sure, it's via MP3 files over HTTP, but an <audio> tag can pull that, Amazon could (and perhaps does) implement their cloud player in that manner anyway.

Valve's Steam distributes a great deal of games without DRM - games are high margin products compared to music singles or DVDs, yet they seem quite successful. I try, or often only buy DRM-free games on Steam to support them.

Apple's iTunes switched in the past few years to distributing music without DRM that encumbered their files and locked in consumers to their iEcosystem. Those files can be uploaded, trivially, to any file sharing network.

The Gordian knot of the problem of piracy and DRM is that only one dedicated person needs to leak it, and as long as I can listen to, look at or sense content, the analog hole will exist. Content industries have tried the approach of treating all of their customers like criminals, and it's been awful for consumers and the amount of content available trivially on peer to peer networks hasn't decreased or even decelerated, as far as I can tell. This treating everyone like a criminal to prevent one dedicated attacker is insane in the colloquial sense, wherein content companies try DRM over and over again and expect different results.

I say, let Hollywood and the video content industry squirm until it realizes it needs the internet more than the internet needs it.

(Perhaps not the best example with respect to my concern here, but one widely cited example of this: Flash to view the menu of a restaurant I'm interested in or scheduled to visit.)

I fear a DRM mechanism in the standard (and so, with broad, built-in deployment) will be used the same way. You won't get any content without enabling the DRM, and whatever payment mechanism is associated with that.

Whether subscription, or ads. And while I'm not adverse to useful, non-intrusive, safe ads, we've yet to see those realized in a consistent and reliable manner. With DRM, content can be inextricably tied to bad, exploitative, and unsafe ads.

It's not what one thinks it will be used for. It's whatever a developer can twist it to do.

What I find to be similar arguments exist for e.g. not permitting the government to backdoor communications and security systems. It's not always the overt use we worry about; it's often the covert use, whether by government or by third parties.

P.S. I'll add that I'm not a technical expert in this particular area. But, I tend to suspect -- or regardless, look for -- the worst, and I often end up finding it. And doing that in technical environments has been a significant part of my career, where I've done quite well at finding and solving problems before they cause catastrophes (or, as the case may be, after).

TL;DR: I fear this baked in DRM as a closed channel for any and all sorts of dangerous as well as annoying crap and behavior.

I'm not claiming to have a solution to all the current woes. But I don't see this going in the right direction.

Flash and Silverlight at least live in userland and have public API (NPAPI). AFAIK using them in your own browser is not a DMCA violation.

OTOH EME deliberately does not define any API between browser and CDMs, so DRM vendors have opportunity to license CDMs to selected browser vendors and make playback with "unapproved" browsers (e.g. your own open-source build) a DMCA violation.

At least Microsoft and Adobe would refuse to implement DRM that is too user-hostile in order to save their eroding reputation and install base.

But with EME you have to run whatever binary Netflix tells you to install, and that will do whatever people who pull the strings on Netflix want.

We saw how well that played out with ActiveX. This is pretty much the same, just even less open-source friendly, since the intent is the deprive the machine running the code of access to the content. Let's not make a rerun of that.

The second this goers mainstream expect a bunch of free "porn sites" saying you need to install their "DRM plugin" to view the content. And voila you have browser-assisted trojan installations.

Firefox and other browsers supporting the open-web, without DRM, will have leverage that it doesn't ship with a gaping open door for spyware, malware and viruses to enter.

It will be the only browser with the user's interest in mind. We've already seen how Google is abandoning that in Chrome. This will only make it more apparent.

It's a big "fuck you peons" repeated again and again. If you can't see that, you're clearly not looking.