DRM and the Challenge of Serving Users
blog.mozilla.org
blog.mozilla.org
I get that slippery slope arguments are often problematic, but DRM has always been something where we've slid down as much as is allowable as soon as it is allowable. The broadcast flag, Macrovision on DVDs, SCMS, Cinavia, etc. are just a few examples of this.
Highly recommended reading is also this post, which discusses how Mozilla will implement EME: https://hacks.mozilla.org/2014/05/reconciling-mozillas-missi...
I also don't feel the 'open source sandbox' will be permissible by most developers of CDMs. My opinion is that mozilla will waste countless cycles implementing EME that won't be acceptable to the content mafia. Adobe is not the only player in this space.
And I don't know how you educate folks. These are the same people who would shrug their shoulders and say "So what," about NSA wiretapping. "I don't have anything to hide."
There is no thought given to the possibility of abuse in the future once these rules or systems are entrenched and standardized.
And now I officially sound like RMS-lite ;)
Do you have any other sources that indicate this push? Seems a possibility but it's the first I've heard of this kind of lockdown. Seems like the cost would greatly outweigh the benefits...
This matches what has happened in practice over the years. Ads and entertainment have been packaged up in Flash with DRM. EME paves that cowpath.
It can't be said for all users. I don't want it. No DRM junk in the browser please. I understand that she probably means some estimated majority, which is unfortunate (i.e. majority accepting unethical practice like DRM).
> Firefox users would need to use another browser every time they want to watch a controlled video
Irrelevant for many users of DRM-free OSes (like Linux) who won't have any DRM backend for EME anyway. I.e. it really sounds like "users would need another OS".
> Each person will be able to decide whether to activate the DRM implementation or to leave it off and not watch DRM-controlled content.
I hope there will be a switch for disabling the whole EME altogether. Even better, I'd prefer builds of Firefox free of any DRM sickness. It's very unfortunate that this garbage is finding its way into the open source browser which always stood for the users' rights more than many others.
Are you kidding? DRM is great. I love being able to just pay money to Netflix in return for content. DRM enables that nice, clear-cut transaction. What's the alternative? Judging by the rest of the web, it involves tracking your internet activity and throwing advertising in your face.
The only way it would be an issue is if you're trying to rip the stream. But if you've paid the provider for streaming only, rather than to download and keep a copy, then that's also not really degrading the quality of service. Similarly, the prohibition on bringing a video camera in to record cinema screenings does not reduce the quality of the cinema experience.
In general, I don't really see a problem with DRM that is temporally bound to the moment of consumption.
It is crippling usability in several ways:
1. DRM is usually not portable (or not ported at least). I.e. most probably it's tied to certain devices / operating systems / applications and etc. For the end user it translates to "you can't watch it on the device / operating system / application of your choice".
2. DRM prevents backups. If the service goes bust or you lose connectivity - you have no access to your data.
3. DRM poses a security / privacy threat. Being transparent doesn't make it any better - it only makes it worse (think of a hidden camera).
All those are clearly examples of degraded usability no matter how "transparent" some DRM is.
I don't think backups are relevant to DRM-laden streaming video, given that it's someone else's data that you happen to be observing.
I'm not sure what you mean by a security and privacy threat. Surely it is no more of a threat than visiting potentially untrusted websites, or using closed-source or unverified open-source binaries, in the first place?
It's not the case for any normal standard portable format (video, audio, etc.). They can be accessed on any platform. DRM prevents that limiting your options where and how to use it. If you take tapes analogy, you can play your tape in any player. Imagine a tape which is only playable in Sony player or whatever. It's clearly a defective product in my view.
> I don't think backups are relevant to DRM-laden streaming video, given that it's someone else's data that you happen to be observing.
That's exactly the point. It means usability is reduced if anything goes wrong with the service or you can't connect to it or whatever other similar reason.
> I'm not sure what you mean by a security and privacy threat.
Since DRM is based on distrusting the user (assuming all of them are potential criminals by default), symmetrical treatment for it from the user's side should be "always potential malware by default". Here is a good example of this: https://en.wikipedia.org/wiki/Sony_rootkit
Since DRM is always a black box / closed code, it adds to the reasons to never trust it.
The same arguments apply to the issue of backups. It would be highly unusual for the only copy of a media product to be only accessible via a DRM-encumbered streaming video service.
I do see your point on the lack of trust though. In this case, hopefully Mozilla's sandboxing approach would go some way towards mitigating that. And the inevitable disassembly of whatever closed-source binary they release.
If you put that in perspective of recent privacy / mass surveillance issues, DRM is a perfect ground for various agencies to put their effort it. After all, DRM is already by design intended to spy on users and control what they do, plus DRM is massively deployed because many consumers accept it without second thought.
Essential means technically and financially essential. I.e. without it the service can't work or can't bring profit. DRM is neither of that. Those who require DRM [publishers] have no technical or financial reasons to justify it. No valid ones at least (all reasons they usually voice are false, and their true reasons they usually don't voice).
1. Monopolistic lock-in. DRM is more than often used to control the market. It happened with Apple in the past, and was one of the key reasons that music publishers realized that being DRM-free is actually better for them.
This reason also includes DRM derivatives like DMCA-1201 and the like. It's all about control (over the markets, over users and etc.).
2. Covering one's incompetence. DRM is used to justify failing sales (i.e. when execs are questioned about why the product performs poorly, they say "Pirates! But worry not - we put more DRM in place").
3. Ignorance and / or stupidity (many execs have no clue and might believe that DRM actually provides some benefit). This type can be called DRM Lysenkoism.
None of these reasons are valid, all of them are crooked and anti-user, but they are often present in various combinations.
How does this benefit the publisher? They already have a exclusive rights to whatever particular movie you're watching.
When publishers realize that monopoly falls to some other hands, they quickly become sober and find common sense. When monopoly remains theirs, they pretend that DRM is needed for other reasons.
A turnstile isn't very hard to jump over. If the turnstile is the only enforcement mechanism, anyone who wants a free subway ride just has to vault over (or perhaps also glance around to see if there are cops nearby, google whether there are monitored cameras, or pull a hoodie over their face).
There's an alternative, though: most places in Europe, there are no turnstiles, and nothing preventing you from getting on public transit without paying. It's a "trust but verify" system: you are required to validate your ticket before you get on the train, and occasionally someone comes around the train to check if you have a valid ticket, and issues a fine if you don't have one.
With this method, the users aren't inconvenienced, enforcement costs are reduced, and everyone's happy. With the turnstile, you get massive queues at busy stations during rush hour, and by making this one mechanical device your sole point of enforcement, you've actually made it more likely that people who don't want to pay will cheat the system.
That's quite a false dichotomy, since the service clearly can exist independently of DRM (both technically and economically).
Furthermore, this dichotomy doesn't work either in your analogy (there are ads on the subway, and yet I still have to pay) or in the real case we're talking about (Hulu+ is paid service locked down by DRM, and it still shows advertisements).
About renting vs. sales see https://news.ycombinator.com/item?id=7745797
There's no reason a BitTorrent movie downloader couldn't be made just as easy to use as a Netflix downloader. If one doesn't already exist, it's not because DRM is somehow stopping it.
It's not just reasonable, it's easily demonstrated in practice, when goods released with DRM are pirated almost right away (with DRM being scraped off). Sophisticated pirates are needed to break DRM. Unsophisticated ones get it from them without any hassle. Which means that DRM has no effect altogether except on legitimate users!
I.e. the vast majority of pirates never deal with any DRM, and experience of legitimate users is always degraded by it. It's pure common sense that removing DRM would always improve any service. And the fact that it's not happening is caused by other reasons (see above).
Similarly, some places don't use DRM. I don't think it's made it into the video space yet, but legitimate DRM-free music is common. It seems to work pretty well.
To say that DRM enables the service to exist only works if there's no other, better way. But there is, and the only reason we don't get to have it is because of customer-hostile policies from media companies.
So: NO.
How hard would it be to make an app that made this easy for non-technical users, without DRM?
And in any case, this misses the point: non-technical users won't distribute pirated content, even if they could rip it. Who are they going to distribute it to? Friends? Whoever wants free movies, can get them easily. But the main advantage of streaming, on-demand-ness, remains in the hands of the big players, who can afford to lease the servers and pay for the bandwidth.
I don't know, but however long, it apparently wasn't prohibitive. And I don't think it'd be tough to clone.
Edit: To be clear, I'm saying that people will pay for a legal streaming service even if they could rip it off for free.
It isn't hard to screen-record, and it never will be. As long as that exists, what's the point of DRM anyway?
Now let the market decide.
In concept, I think it's not too much different from server-side website code being mostly closed source. The only difference is that this component happens to be running on your computer.
Also there is prior form for this in similarly open systems, e.g. tainted modules in the Linux kernel, which seem to have turned out okay.
At first glance this may seem pretty "reasonable", but it really isn't. It's like putting a backdoor in every Intel chip (such as say through TPM 2.0), and then just telling people "look, if you don't want the backdoor activated, you can disable it - Now here's the list of 10 instructions to do so..."
It's an illusion of choice, and nothing more. While some may be content that this option exists, the reality is that DRM is now getting pushed to billions of users out there through the web, as the default for soon most video platforms.
I don't fully blame Mozilla for this. In fact I blame Netflix first, and Google and Microsoft second. This Gang of Three is the one that made it happen in the first place. But I am saying that Mozilla's attempts to alleviate our concerns aren't very effective or particularly useful.
Drm is the opposite of serving users. By definition. The "challenge" is actually to select which privileged users you still want to serve in spite of the not-serving default.
We don't get DRM-free copies of all our music from Spotify, nor should we reasonably expect that. We are subscribing to a service that allows us access to music so long as we are paying customers. Why shouldn't there be light-touch DRM in place to keep us from flagrantly abusing the system and retaining all copies of the music after if/when we cancel our subscription?
Should we reasonably expect to be able to keep a copy of a television show that we streamed from abc.go.com? ABC makes far less money from showing us ads than if we purchased a copy from iTunes. They do this, part and parcel, because we don't get to keep a copy of the show after we're done watching.
From my perspective, DRM has no place in a "sales" relationship. We should have full usage rights whenever we buy a book, movie, or song.
DRM should exist for subscription services and ad-supported streaming. DRM should essentially serve to enforce the social and legal contract that says we are "borrowing" the books, movies, or songs for long as we have that relationship. Once that relationship is over, we can't use that stuff any more.
I suggest that we create an open-source DRM system designed to fairly protect the content creator in cases where the audience is "borrowing" the creative work (whether ad-supported or subscription).
Why not? I use a number of internet "radio" stations that send DRM free mp3 streams to my computer (complete with ads). Some even have paid accounts that stream at a higher bitrate.
The only reason Spotify can't do that is because the recording studios act like frightened little children, scared that someone is going to take their toys away. They've (somewhat successfully) planted the meme that DRM is required or the evil pirates will just steal everything and they'll go out of business. But I just don't buy it.
Mozilla, please remove this anti-feature. Do the right thing.
Why not have this downloaded upon first use, the way that Flash and Silverlight have been?
Also, isn't this what users on many Linux distros (e.g. Iceweasel on Debian) will have to do anyway?
That's actually what we're looking at doing: the sandbox would be in there, harmless, by default, but the actual crypto module (the "CDM") would download from Adobe upon first need. (And they have committed to support the platforms we support, Linux included.) The exact UI is still up in the air. I could imagine us using the opportunity to display a message to educate users as to what DRM is and whose phone number to call if they don't like it. ;-)
Please do this!
I understand that Mozilla has been backed into a corner on this, so I get why you'll be adding this (much as I wish you didn't have to). But that doesn't mean forgetting about the issue entirely.
I wouldn't ask this of any of the other major browser vendors, but I like to hold Mozilla/Firefox to a higher standard. :)
Edit: Ah, I see. https://hacks.mozilla.org/2014/05/reconciling-mozillas-missi... clarifies the intent to remove plugins from the web altogether.