|
|
Log in / Subscribe / Register

EME is now a W3C recommendation

The World Wide Web Consortium has put out a press release trumpeting its publication of the "Encrypted Media Extensions" as an official recommendation and enshrining DRM into what was previously a standard for open communication. See the EFF's open letter for a less rosy view of this development. "Today, the W3C bequeaths an legally unauditable attack-surface to browsers used by billions of people. They give media companies the power to sue or intimidate away those who might re-purpose video for people with disabilities. They side against the archivists who are scrambling to preserve the public record of our era. The W3C process has been abused by companies that made their fortunes by upsetting the established order, and now, thanks to EME, they’ll be able to ensure no one ever subjects them to the same innovative pressures."

to post comments

EME is now a W3C recommendation

Posted Sep 18, 2017 22:03 UTC (Mon) by fratti (subscriber, #105722) [Link] (3 responses)

So when is LWN moving to Gopher?

EME is now a W3C recommendation

Posted Sep 18, 2017 22:10 UTC (Mon) by corbet (editor, #1) [Link] (2 responses)

Why would we ever do that? We're drooling over all of the DRM-encumbered content we can start putting out now! :)

EME is now a W3C recommendation

Posted Sep 19, 2017 1:41 UTC (Tue) by pabs (subscriber, #43278) [Link] (1 responses)

Will EME be open to all businesses instead of just the large media/content companies?

EME is now a W3C recommendation

Posted Sep 19, 2017 3:14 UTC (Tue) by roc (subscriber, #30627) [Link]

I believe you can publish content using Widevine free of charge.

EME is now a W3C recommendation

Posted Sep 18, 2017 22:40 UTC (Mon) by donbarry (guest, #10485) [Link] (37 responses)

This day of infamy marks the death of the World Wide Web Consortium as an entity deserving of any trust from the public. It has repudiated its one-time defense of the web as an open and interoperable venue on which the world's communications and culture could take place -- now it prostitutes itself before corporate mammon.

That the EFF resigns only today, and admits to neutering itself for a period in search of a compromise now revealed, in retrospect, unsurprisingly utopian, does not paint them in the best light either. Unlike the WWWC, however, I do not distrust their bona fides.

Who to turn to? In the end, only ourselves. Mozilla, while protesting too much, hoist its petard to EME three years ago, all the while hypocritically claiming its embrace gave it "influence".

EME is now a W3C recommendation

Posted Sep 18, 2017 23:01 UTC (Mon) by roc (subscriber, #30627) [Link] (35 responses)

How would forcing everyone who wants to watch Netflix and other DRM content in a browser to switch from Firefox to Chrome have benefited the open Web?

EME is now a W3C recommendation

Posted Sep 19, 2017 9:29 UTC (Tue) by gowen (guest, #23914) [Link] (28 responses)

This is the question these threads always leave me asking ... how is it advantageous to my freedom that I can't watch Netflix, or MLB.tv or any other subscription TV service using Free Software? Exactly what freedoms are we preserving here? In what way is anyone's freedom enhanced by making me dual boot to Windows to watch old episodes of Seinfeld and Seattle Mariners games?

The long and short of it, if you want to convince non-zealots that EME are a bad thing, its not enough to talk in the abstract, you need to demonstrate whatever harm they actually cause.

EME is now a W3C recommendation

Posted Sep 19, 2017 10:42 UTC (Tue) by eru (subscriber, #2753) [Link] (21 responses)

how is it advantageous to my freedom that I can't watch Netflix, or MLB.tv or any other subscription TV service using Free Software?

But is that possible with EME? It seems some any such scheme must include locked components, down to the display driver level, otherwise you could just modify the browser to pipe the decrypted contents into a file. Hmm, if EME cannot prevent this "crack", I'm all for it...

EME is now a W3C recommendation

Posted Sep 19, 2017 12:39 UTC (Tue) by excors (subscriber, #95769) [Link] (11 responses)

It seems possible in theory. Implement the DRM restrictions with some combination of hardware and firmware. Store a secret key plus a public signing key in some secure hardware block, which will only reveal the secret key to correctly-signed firmware. Let the user update both keys together (but they can't update just one by itself).

The firmware would be given an encrypted bitstream, and would return some opaque ID that can be passed to the display compositing hardware to draw the decoded frame, and would ensure all decrypted/decoded data is in secure memory that can't be accessed by e.g. the OS kernel.

The manufacturer can publish the source code for the firmware, and a signed binary, which uses the device's secret key to decrypt all the other DRM keys it needs. A user can freely modify and rebuild the firmware, but they'll have to replace the device's signing key with their own, which means they'll have to replace the secret key too. If they have an arrangement with the DRM licensing people they can generate a new secret key and encrypt the DRM keys with that, and it will work exactly the same as the manufacturer's firmware. If they don't, they don't get DRM but won't lose any other functionality.

EME is now a W3C recommendation

Posted Sep 19, 2017 14:31 UTC (Tue) by nybble41 (subscriber, #55106) [Link] (10 responses)

> A user can freely modify and rebuild the firmware, but they'll have to replace the device's signing key with their own, which means they'll have to replace the secret key too. If they have an arrangement with the DRM licensing people they can generate a new secret key and encrypt the DRM keys with that, and it will work exactly the same as the manufacturer's firmware. If they don't, they don't get DRM but won't lose any other functionality.

In other words, working DRM is incompatible with the freedom to modify the firmware, a key aspect of Free Software. If you attempt to exercise your theoretical freedom then the media you've payed for stops working on that device. You can have Free Software or DRM, but not both at the same time.

EME is now a W3C recommendation

Posted Sep 22, 2017 11:21 UTC (Fri) by hummassa (guest, #307) [Link] (9 responses)

Just one nitpick:

There is no such thing as "working DRM". Someone made a proof-of-concept where with a big screen TV, eight cheap webcams and some calibration, they managed to lossless reconstruct the pixel content of any DRM-encumbered 1080p video. I suppose it's outdated now (4k, 8k anyone) but at the same time the principle is probably still valid.

DRM is just a mathematical impossibility, because Bob and Eve are the same person.

EME is now a W3C recommendation

Posted Sep 22, 2017 12:21 UTC (Fri) by jezuch (subscriber, #52988) [Link] (7 responses)

Obviously, the next step is requiring that certified TV's refuse to play if the front-facing camera recognises devices recording the screen. As a bonus, they will also stop playing when there's more than one person watching. After all, you bought a *single* licence!

That's how the DRM-pushing corporations think.

EME is now a W3C recommendation

Posted Sep 22, 2017 13:23 UTC (Fri) by zdzichu (subscriber, #17118) [Link]

> As a bonus, they will also stop playing when there's more than one person watching.

Be careful, you would be infringing Microsoft patent: https://www.geekwire.com/2012/microsoft-diskinect-freeloa...
But only in those backward countries which allows such patents.

EME is now a W3C recommendation

Posted Sep 22, 2017 13:26 UTC (Fri) by excors (subscriber, #95769) [Link] (5 responses)

But what if you put the TV opposite a mirror, so its own camera records itself recording the screen?

DRM doesn't need to make it entirely impossible to copy a video anyway, it just needs to make it awkward enough that most people would prefer to spend $10/month on Netflix to avoid the hassle. If it stops someone buying a movie legitimately on their phone then streaming it on Facebook Live to a hundred friends (because their phone knows it's protected content and refuses to record it, at a deep enough level that they can't just install a rooting app to get around it), and those friends can't be bothered to wait hours downloading it over BitTorrent (with a good chance of finding it's a terrible-quality recording or is dubbed in Portuguese), so a few of them buy the movie themselves, it has done its job.

EME is now a W3C recommendation

Posted Sep 22, 2017 15:16 UTC (Fri) by nybble41 (subscriber, #55106) [Link] (3 responses)

> DRM doesn't need to make it entirely impossible to copy a video anyway, it just needs to make it awkward enough that most people would prefer to spend $10/month on Netflix to avoid the hassle.

Due to the nature of digital copies, it only takes one person getting around the DRM to render the DRM completely ineffective for everyone.The threat model is not "each individual could strip the DRM from their own media", it's "a single group of enthusiasts could strip the DRM and upload their DRM-free copy to the world".

> If it stops someone buying a movie legitimately on their phone then streaming it on Facebook Live to a hundred friends...

No one would do that anyway. For live sports, perhaps, or the initial broadcast of a TV show, but not for a movie. And this is the only part that actually depends on DRM; the other possible inconveniences (time to download, risk of low quality) would be no different if the official release were DRM-free.

> ... can't be bothered to wait hours downloading it ...

It wouldn't take "hours" with a modern Internet connection—and streaming over BitTorrent is a thing. It's not quite as efficient, but clients can request pieces in order or even on demand (look up "btfs"). Even if it did take "hours", that would just mean you have to plan ahead a bit. Not a big deal.

> ... with a good chance of finding it's a terrible-quality recording or is dubbed in Portuguese ...

Ubiquitous review and reputation systems make that extremely unlikely.

> ... so [if] a few of them buy the movie themselves, it has done its job.

But at what cost? "A few" extra sales are not going to cover the millions of dollars wasted on developing new DRM schemes, never mind the less tangible costs such as loss of goodwill. Do they really think they can survive going to war against their own market? They might think they're only going after "freeloaders" (not that there is any "load" involved), but their paying customers are the ones suffering the most damage.

EME is now a W3C recommendation

Posted Sep 22, 2017 20:57 UTC (Fri) by anselm (subscriber, #2796) [Link] (2 responses)

The threat model is not "each individual could strip the DRM from their own media", it's "a single group of enthusiasts could strip the DRM and upload their DRM-free copy to the world".

It is safe to assume that anything halfway interesting is already available, DRM-free, from shady sources long before it ever hits Netflix, so for a content provider (other than Netflix's own content division), worrying that some “single group of enthusiasts” could get something interesting off Netflix that they haven't long before been able to find somewhere else is a bit silly.

The business model of Netflix is built on the assumption that enough people prefer paying $10/month for conveniently packaged high-quality content to dealing with shady sources on the Internet. So far it seems to be working.

EME is now a W3C recommendation

Posted Sep 22, 2017 21:53 UTC (Fri) by nybble41 (subscriber, #55106) [Link] (1 responses)

> It is safe to assume that anything halfway interesting is already available, DRM-free, from shady sources long before it ever hits Netflix... The business model of Netflix is built on the assumption that enough people prefer paying $10/month for conveniently packaged high-quality content to dealing with shady sources on the Internet.

This is exactly why DRM on Netflix is pointless. To circumvent it you don't have to break the DRM at all; you just get the same content from another source. Any resources spent on developing that DRM are wasted, and paying customers are being inconvenienced by it for absolutely no reason.

EME is now a W3C recommendation

Posted Sep 22, 2017 22:35 UTC (Fri) by anselm (subscriber, #2796) [Link]

To be fair, having DRM is probably not Netflix's idea in the first place. The more people are in a position to subscribe to Netflix at $10/month a pop, the better for Netflix, and on the whole, DRM hurts more than it helps with that from a technical POV. In fact it is really the content providers (Hollywood studios and perhaps Netflix's own content division) who insist on DRM, on general principles. Since nobody is interested in a DRM-free video service that doesn't offer what people would like to watch (blockbuster movies and recent TV series), there is little Netflix can do except deploy DRM simply in order to stay relevant from a portfolio POV.

(Until not so very long ago Netflix didn't mind if people were using proxy servers or VPNs to get at shows on Netflix that Netflix didn't offer in their own country of residence. After all, Netflix is in the business of giving people what they'd like to watch, and, e.g., Germans who are happily watching shows on UK Netflix are happy Netflix customers, so for the longest time Netflix was turning a blind eye on the practice. In the end Netflix had to crack down on proxy servers and VPNs because the content providers didn't like the idea.)

EME is now a W3C recommendation

Posted Sep 22, 2017 20:24 UTC (Fri) by lsl (subscriber, #86508) [Link]

The primary job of DRM is not to prevent illegal copying. It is control over the playback experience. Even broken DRM achieves that pretty well: most licensed playback devices don't allow skipping ads or ignore region coding. DRM gives content owners veto rights over available features. Licensed players will not provide a particular feature if content owners think they can possibly monetize it at some later point. Want to have some BluRay movie you own on your tablet to watch it on the train? Sure, but you have to buy the Itunes version of that movie.

Neither skipping ads, nor ignoring region codes or watching a movie you own on a different devices have anything to do with copyright infringement. These things are perfectly legal to do if it weren't for DRM which you are not allowed to bypass.

WHATWG editor Ian Hickson wrote about this a few years ago:
https://plus.google.com/+IanHickson/posts/iPmatxBYuj2

EME is now a W3C recommendation

Posted Sep 22, 2017 14:50 UTC (Fri) by nybble41 (subscriber, #55106) [Link]

> There is no such thing as "working DRM". ... DRM is just a mathematical impossibility, because Bob and Eve are the same person.

I agree with you on that point, but I meant "working" as in "allows you to use the media you payed for" (i.e. working from the users' perspective), not "prevents copying" (working from the content providers' perspective). As a rule these interests are diametrically opposed to each other: the closer you get to a DRM scheme that can actually prevent copying, the more trouble it causes for the users.

EME is now a W3C recommendation

Posted Sep 19, 2017 16:01 UTC (Tue) by davidstrauss (subscriber, #85867) [Link] (3 responses)

All I know is that I run Chrome on Fedora with Intel graphics (and the standard FOSS drivers) and have no trouble streaming Netflix or Hulu. I don't think Chrome has any control after handing data off. It certainly doesn't object to being run as X-on-Wayland versus native X, which suggests that the path isn't tightly controlled after the browser has painted it. GNOME's screenshot tool even has no trouble catching the content, so it's not bypassing the desktop compositor.

EME is now a W3C recommendation

Posted Sep 20, 2017 7:16 UTC (Wed) by jospoortvliet (guest, #33164) [Link] (2 responses)

Correct, this uses flash and now this great new standard is out it can be phased out and more suitable requirements can be drawn up and implemented including full stack protection against stealing content. No more will you be able to record and publish Netflix content as I am sure you do. Nor will you be able to watch it of course.

Yes there is a dose of sarcasm here. Raspberry pi media centers are dead as are many other nice small boards for that purpose. :-(

EME is now a W3C recommendation

Posted Sep 20, 2017 11:07 UTC (Wed) by roc (subscriber, #30627) [Link]

It's almost certain that anyone watching Netflix in Chrome or Firefox on Linux today is not using Flash but EME.

The only barrier to having this work on a Raspberry Pi is getting Google to release an ARM Widevine module for desktop Linux. I'm not sure why EME is regressing anything here ... do you have a Flash plugin that supports DRM and works on the Pi?

EME is now a W3C recommendation

Posted Sep 20, 2017 11:55 UTC (Wed) by anselm (subscriber, #2796) [Link]

According to rumor, Kodi 18 will come with support for Widevine DRM on ARM, in order to enable support for Netflix and Amazon Prime Video.

The problem with the Raspberry Pi is mostly that it may not be fast enough to deal with Widevine-protected content in software on the CPU (rather than non-DRM content on the GPU); more powerful ARM-based media center solutions such as the OSMC Vero 4K should be able to cope.

EME is now a W3C recommendation

Posted Sep 19, 2017 23:05 UTC (Tue) by roc (subscriber, #30627) [Link] (4 responses)

Whether you believe in it or not, it does work. Just last night I watched a BBC show via Netflix in Firefox on Linux.

There isn't decoder-to-screen protection of pixels, so that limits the video resolutions Netflix is willing to offer. It's not a good idea to shout from the rooftops about how this lets you copy video, because in the unlikely event the content producers pay attention, their reaction will not be "oh, let's just drop DRM then" as nerds fantasize. Instead they will stop allowing playback on platforms like desktop Linux that don't protect pixels to the screen.

EME is now a W3C recommendation

Posted Sep 20, 2017 3:13 UTC (Wed) by foom (subscriber, #14868) [Link] (1 responses)

Because, as everyone knows, HDMI's HDCP DRM is perfect protection for the path from the video card to the TV. So, as long as the pixels are protected from Netflix to the video card, that'll take care of the rest, so it will be 100% protected.

There's certainly no way HDCP stripper devices would be available for sale on Amazon.com. Nope, no way. Definitely not.

EME is now a W3C recommendation

Posted Sep 20, 2017 4:08 UTC (Wed) by roc (subscriber, #30627) [Link]

I appreciate your point, but it in no way alters what I said. Your logic and facts do not work with these people.

EME is now a W3C recommendation

Posted Sep 20, 2017 4:08 UTC (Wed) by eru (subscriber, #2753) [Link] (1 responses)

OK, so it is just like every other "copy protection" scheme seen so far: It attempts to discourage casual copying, but is no absolute obstacle. That is probably sufficient for businesses like Netflix.

EME is now a W3C recommendation

Posted Sep 20, 2017 8:15 UTC (Wed) by anselm (subscriber, #2796) [Link]

As long as people can video their monitors, complete “copy protection” is an illusion, anyway, and Netflix isn't in the business of turning away paying customers, even if they're running Linux.

From a business POV, Netflix is walking a tightrope between (a) offering a service that people will find interesting enough to pay Netflix $10/month and (b) not annoying content providers, such as movie studios and TV production companies, to a point where they no longer want Netflix to offer their stuff (which as far as Netflix is concerned would hurt goal (a)). Accommodating Linux-based subscribers furthers goal (a), and limiting the resolution of video streams on Linux to where it isn't commercially interesting to grab them for illicit distribution downstream (when you can get high-quality versions of the same stuff to pirate somewhere else) furthers goal (b).

Personally I'm glad I get to watch Netflix on Linux at my home-office desk or when I'm staying at a hotel somewhere, even if it doesn't look perfect. It does look way better on my home theatre setup which is streaming Netflix in full HD using a Sony BluRay player as its Netflix client, but that is something I can live with.

EME is now a W3C recommendation

Posted Sep 20, 2017 5:56 UTC (Wed) by paulj (subscriber, #341) [Link] (5 responses)

How is it advantageous to my freedom to give it up, just so that you can watch some old comedy shows, or watch grown, vastly overpaid men, throwing a ball around and beating it with a stick?

EME is now a W3C recommendation

Posted Sep 22, 2017 8:13 UTC (Fri) by coriordan (guest, #7544) [Link] (4 responses)

The two main advantages to fans of software freedom are that by not chasing away >90% of Firefox's userbase, Firefox (1) maintains its funding and continues to be developed and (2) continues to have some influence in the direction the web goes.

I don't want that to be the truth, but I think it is.

(It's obviously not binary and we've just seen that their influence doesn't guarantee victory, but they've won other battles.)

If we want Firefox to not be placed in the position of having to make these lose-lose choices, we have to convince the general public that DRM is not acceptable.

EME is now a W3C recommendation

Posted Sep 22, 2017 8:43 UTC (Fri) by lkundrak (subscriber, #43452) [Link]

> If we want Firefox to not be placed in the position of having to make these lose-lose choices, we have to convince the general public that DRM is not acceptable.

I think you make a very good point here.

EME is now a W3C recommendation

Posted Sep 24, 2017 10:45 UTC (Sun) by paulj (subscriber, #341) [Link]

So, to preserve freedom, we must give it up today and comply with the freedom-restricting monopolists, in the hope that <something one day>. That's not a tactical retreat, where you cede ground and hope to consolidate and win elsewhere. That's capitulation.

We can try dress it up as "live to fight another day", but it looks to me like there's no fight anymore.

on Firefox

Posted Sep 28, 2017 11:53 UTC (Thu) by Herve5 (guest, #115399) [Link] (1 responses)

I find the above contribution the most significant of all the thread till now...
Worth a 'Mod parent up' on Slashdot ;-)

on Firefox

Posted Sep 28, 2017 16:31 UTC (Thu) by jiiksteri (subscriber, #75247) [Link]

> I find the above contribution the most significant of all the thread till now...

+1

If we keep replying to this, the (now grand-)parent post gets the attention it deserves via people going through "Unread comments" :)

Call me cynical but I don't think there's a browser that could make DRM go away. If browsers don't support DRM extensions, content owners will develop creative ways of distributing DRM'd content to consumers, be it per-browser extensions or custom clients.

And arguably that's a worse place to be at for everyone.

With standardized DRM extensions, if there are security problems found with an EME implementation, having a browser in between means the browser vendor can have ways to warn the consumer about problems. And there's a centralized place to block content, should you choose so.

So even if one hates DRM in general, the browser/W3C level is the wrong place to complain about it, and that particular fight should be taken to the content owners. The browser is your friend here :)

EME is now a W3C recommendation

Posted Sep 19, 2017 12:26 UTC (Tue) by Zack (guest, #37335) [Link] (5 responses)

Not everyone wants to watch Netflix and other DRM content in a browser would switch from Firefox to Chrome, at least not permanently. For a long time people have used two browsers, IE for IE "optimised" content, and Firefox for anything else.

The open web would have benefited from a major vendor not playing along by being able to point at a significant amount of traffic that would be lost. Obviously Netflix et al would still have 100% of their traffic from EME enabled browsers, but it would protect the long tail of the web from the demands of advertising.

"But Firefox would quickly become a fringe browser if they don't cater to the washed masses."

Maybe. Probably. Once upon a time Mozilla had a core group of users that would stick by it and would have maintained a percentage that might just have been enough to counter divisive practices like EME, but Mozilla have sold those users down the river a long time ago in accordance with their new motto, "not out hill to die on; never our hill to die on," leaving them just another vendor trying to play technical catch-up with Chrome.

So yeah, the open web died because of pressure by big content who wanted to have absolutely nothing to do with the Web not so long ago, but now consider it their domain and privilege with all other consideration void and null. We won't even have Paris, because it will be locked away.

EME is now a W3C recommendation

Posted Sep 19, 2017 13:43 UTC (Tue) by pizza (subscriber, #46) [Link] (1 responses)

> Once upon a time Mozilla had a core group of users that would stick by it and would have maintained a percentage that might just have been enough to counter divisive practices like EME, but Mozilla have sold those users down the river a long time ago [...]

That percentage has *never* been anything more than a rounding error on their overall userbase.

EME is now a W3C recommendation

Posted Sep 21, 2017 16:53 UTC (Thu) by tome (guest, #3171) [Link]

Shucks. I'm a loyal firefox user. I even wear old firefox 'take back the web' T-shirt swag I picked up at OSCONs over 10 years ago. If what you say is true, and I spoz it is, then I'm just another weirdo who missed the bus. Dang that hurts.

EME is now a W3C recommendation

Posted Sep 19, 2017 23:34 UTC (Tue) by roc (subscriber, #30627) [Link] (2 responses)

> The open web would have benefited from a major vendor not playing along by being able to point at a significant amount of traffic that would be lost.

DRM proponents would not lose any traffic. That's the problem.

> it would protect the long tail of the web from the demands of advertising.

I have no idea what this means.

There is a meme going around that EME somehow enables more pernicious advertising. It makes no sense. EME is just an extension to video decoding and rendering, and the browser can block EME video just like any other video. In Firefox at least, the browser mediates CDM storage so can corral and wipe CDM-stored data just like any of the other forms of Web client-side storage.

I think some people imagine a future where somehow a whole site is delivered through EME. Today that's about as realistic (and effective) as delivering your whole site as an MP4 video. To make it more realistic would require massive new APIs, which should be fought on their (lack of) merits.

DRM is bad, but EME is not the open-Web-ending apocalypse you and others make it out to be.

> Once upon a time Mozilla had a core group of users that would stick by it and would have maintained a percentage that might just have been enough to counter divisive practices like EME

There have never been enough Stallman-esque users to sustain a viable independent browser.

> "not out hill to die on; never our hill to die on," leaving them just another vendor trying to play technical catch-up with Chrome.

You're not looking at the big picture. DRM may be the only issue you care about, but it hasn't caused the open Web or Mozilla to lose all value. Mozilla is not "just another vendor". Mozilla continues to do lots of important standards work and advocacy (e.g. http://robert.ocallahan.org/2017/06/webassembly-mozilla-w...), especially by providing one of the three remaining independent engines; take it out of the picture and the open Web would suffer a much bigger blow than inflicted by EME.

Demanding that Mozilla commit suicide in an ineffectual gesture over your pet issue is not fair to the people who care about more than just that issue.

EME is now a W3C recommendation

Posted Sep 20, 2017 17:30 UTC (Wed) by flussence (guest, #85566) [Link] (1 responses)

>Demanding that Mozilla commit suicide in an ineffectual gesture over your pet issue is not fair to the people who care about more than just that issue.
And demanding that the open web commit suicide for your pet streaming service (region-locked and irrelevant to 99% of the world) instead of telling people to go use a quarantine browser for that crap is?

I'm not using Chromium because Mozilla obstinately stood up for its principles, I'm using it because you DON'T. Your browser is technically inferior in nearly every aspect, the moral reasoning was the only reason left *to* use it. And that turned out to be a complete sham!

EME is now a W3C recommendation

Posted Sep 21, 2017 6:19 UTC (Thu) by roc (subscriber, #30627) [Link]

Google sells DRM. Mozilla conceded because fighting it was a hopeless battle. If you really don't see any difference between Mozilla and Google anymore, check your vision.

The open Web still has a lot going for it. It hasn't suddenly turned into some walled garden. Again, if you think standardizing the ability to play DRM-protected video has suddenly made the open Web completely irrelevant, you're failing to see the big picture.

EME is now a W3C recommendation

Posted Sep 20, 2017 17:13 UTC (Wed) by flussence (guest, #85566) [Link]

>This day of infamy marks the death of the World Wide Web Consortium as an entity deserving of any trust from the public.
And not the several *thousand* days during which Microsoft cowardly hid behind the consortium as an excuse to stonewall the standards work WHATWG was doing? Come on now, it's been a farce detached from reality since the days of XHTML2.

EME is now a W3C recommendation

Posted Sep 18, 2017 22:50 UTC (Mon) by roc (subscriber, #30627) [Link] (4 responses)

I think the EFF is mostly correct in condemning the W3C for not fighting harder for concessions from DRM proponents. However, their letter contains some misleading statements.

> But those very benefits (such as improvements to accessibility and privacy) depend on the public being able to exercise rights they lose under DRM law — which meant that without the compromise the Director was overriding, none of those benefits could be realized, either.

This sentence is nonsense. Replacing Flash DRM with EME-based DRM has already produced real improvements in accessibility and privacy (and security). EME has vastly limited the scope of what the closed-source DRM-enabled software can do: from a complete application platform (Flash) running with full user privilege, down to decoding video and audio in a restrictive sandbox. For example, with EME the DRM module's persistent storage is mediated by the browser and can therefore be cleared by the browser at any time.

> Today, the W3C bequeaths an legally unauditable attack-surface to browsers used by billions of people.

A much smaller attack surface than was previously necessary to view DRM'ed content. And if you don't care to view DRM'ed content in the browser, you can disable the DRM modules to eliminate the attack surface, without breaking stuff that doesn't use DRM.

> They [W3C] give media companies the power to sue or intimidate away those who might re-purpose video for people with disabilities.

No they don't, because that power already existed.

EME is now a W3C recommendation

Posted Sep 18, 2017 23:25 UTC (Mon) by pboddie (guest, #50784) [Link] (3 responses)

They [W3C] give media companies the power to sue or intimidate away those who might re-purpose video for people with disabilities.
No they don't, because that power already existed.

Maybe the point was that a range of institutions and popular opinion "give power to" media companies. Previously, this didn't include the W3C, but now they have joined the list. But as the notion of democracy should demonstrate, the fewer who empower hostile entities, the less legitimate those entities become, and hopefully the less powerful they become.

EME is now a W3C recommendation

Posted Sep 18, 2017 23:37 UTC (Mon) by roc (subscriber, #30627) [Link] (2 responses)

That is a very, very weak effect which in no way justifies the EFF's statement.

The power of media companies to impose DRM stems from the observable fact that somewhat less than 0.01% of people would choose to not watch DRM'ed content rather than suffer DRM. (I don't know a single person in this category, not even my DRM-hating nerd friends.) Compared to that, any "legitimacy" bestowed by the W3C is straw in the wind.

EME is now a W3C recommendation

Posted Sep 19, 2017 8:19 UTC (Tue) by andrewsh (subscriber, #71043) [Link] (1 responses)

I would rather not watch DRM content than suffer DRM. I don’t however think EFF’s statement is justified enough. I agree it’s definitely less bad to suffer EME DRM than Flash DRM or Silverlight DRM or some unique proprietary browser plugin DRM.

EME is now a W3C recommendation

Posted Sep 24, 2017 16:25 UTC (Sun) by Wol (subscriber, #4433) [Link]

I'm just not interested in content (DRM *or* *not*) enough to be bothered with the hassle of making sure my browser can play it. Flash spends most of its time broken and, to be honest, I rarely even notice!

Cheers,
Wol

EME is hardly the worst of it

Posted Sep 19, 2017 0:18 UTC (Tue) by brugolsky (guest, #28) [Link] (8 responses)

I have a difficult time mustering much venom for the EME proponents; I browse the web with NoScript enabled, so half of it is broken already, and EME isn't going to change that for me, as I won't ever toggle it on. While I have no problem with loudly complaining about W3C's endorsement of the DRM anti-feature, our real ire and efforts should go towards rolling back the DMCA, which makes certain true statements illegal to utter.

I'm more concerned with the dumpster fire that is the entire W3C (and related) stack. We could have had safe mobile code with privacy, confidentiality, security, and integrity built on principled use of safe programming constructs, strict namespaces, a sane capability model, etc. It's not like the vast majority of issues were not already obvious two decades ago. Instead we have one big dangerous hairball that enables every dark pattern of surveillance capitalism.

EME is hardly the worst of it

Posted Sep 19, 2017 0:31 UTC (Tue) by roc (subscriber, #30627) [Link]

The sort of programming models you're thinking of don't let developers do as much as less restrictive models, and are harder to develop with. Thus, all other things being equal, developers and users flock to the less restrictive platforms. This is true both "in the large" (programming model) and "in the small" (e.g. error-tolerant HTML parsing).

At the beginning of the Web there were many competing hypermedia systems, most of which had much stronger properties than HTML+HTTP. It's not a coincidence that they lost.

EME is hardly the worst of it

Posted Sep 19, 2017 10:34 UTC (Tue) by pboddie (guest, #50784) [Link] (6 responses)

To be fair, there were people involved in the W3C who wanted to take a different path. I remember Steven Pemberton presenting XForms which was going in a rather different direction to that of much of the Web technology stack we see in use today.

Unfortunately, everything went in the direction of mountains of JavaScript monkey-patching itself instead, leading to the "hilarious" experience I had last week when Firefox, with my machine under heavy load, decided it would prompt me about a slow-running script (as it all too often does these days) and ask me if I wanted to terminate it. The script was the one it uses to handle its own user interface.

EME is hardly the worst of it

Posted Sep 19, 2017 10:41 UTC (Tue) by roc (subscriber, #30627) [Link] (5 responses)

The XML approach was never going to work in practice.

For example, every XML site that supported comments always had at least one bug enabling you to slip invalid Unicode into a comment, so that a conforming XML browser would replace the entire page with a parse error for all users. It turns out this is not what developers or users actually want.

EME is hardly the worst of it

Posted Sep 19, 2017 12:57 UTC (Tue) by excors (subscriber, #95769) [Link] (1 responses)

U+FFFE (￾) is good for that, since most software will happily accept that as valid Unicode and encode it and decode it correctly, and end up using it in an XML document. Then it's a well-formedness error, even if they escape it as &#xfffe;, which is surprising.

I think XML without the Unicode weirdness would have been sufficiently robust, though. If you have a user-triggerable well-formedness bug due to bad escaping of markup characters (<, >, ", etc) then that's probably actually an XSS bug and would be just as bad in HTML. (Although admittedly XML still makes that tricky by how you never really need to escape ">", except when it's used in "]]>".)

EME is hardly the worst of it

Posted Sep 19, 2017 13:00 UTC (Tue) by excors (subscriber, #95769) [Link]

Oh dear, I think I broke LWN's RSS comment feed. E.g. Chrome says "This page contains the following errors: error on line 84 at column 24: Char 0xFFFE out of allowed range".

It does rather prove the point, though.

EME is hardly the worst of it

Posted Sep 19, 2017 13:46 UTC (Tue) by pboddie (guest, #50784) [Link] (2 responses)

XForms represented a much broader approach to delivering "rich" functionality than "it's all XML" or however it is perceived now. However, I imagine that Pemberton explains it better than I can.

EME is hardly the worst of it

Posted Sep 19, 2017 23:43 UTC (Tue) by roc (subscriber, #30627) [Link] (1 responses)

Apart from the XML self-flagellation, Pemberton's main theme is "look at all the things we can do without script". But in reality for a complex-enough application you need to write client-side code. You may write it in some XML-ish syntax (e.g. using his <bind> and <setvalue>), but you'd be better off writing it in an actual programming language.

EME is hardly the worst of it

Posted Sep 20, 2017 7:43 UTC (Wed) by gowen (guest, #23914) [Link]

you'd be better off writing it in an actual programming language.
Or, failing that, Javascript. *rimshot*

EME is now a W3C recommendation

Posted Sep 19, 2017 1:46 UTC (Tue) by pabs (subscriber, #43278) [Link] (6 responses)

The EFF resigning from the W3C just hands more control of the organisation to the DRM advocates and their ilk. Increasing their 58% majority while also working externally to reduce it doesn't seem like an efficient use of resources to me.

Source for the 58% remark:

https://boingboing.net/2017/09/18/antifeatures-for-all.html

EME is now a W3C recommendation

Posted Sep 19, 2017 2:47 UTC (Tue) by donbarry (guest, #10485) [Link] (2 responses)

Given that the W3C has declined even the request of the EFF to publish who voted in support, no confidence can be attached any longer to the W3C as a "community" organization.

At this point, the best that can be done is to expose the W3C for what they have become, and to organize outside of the W3C and take the fight to a higher level.

Any organization which so betrays the "free and open" standards it once fought for deserves only to be swept into the dustbin of history.

"free and open"

Posted Sep 19, 2017 10:07 UTC (Tue) by CChittleborough (subscriber, #60775) [Link] (1 responses)

Umm, EME is a "free and open" standard. Vendors are allowed to produce closed-source, proprietary implementations of EME, but the standard itself is free in all the usual meanings of that word.

"free and open"

Posted Sep 19, 2017 13:22 UTC (Tue) by lsl (subscriber, #86508) [Link]

Yeah, because EME only specifies a conduit by which websites can exchange encrypted blobs with proprietary binary-only plugins (the CDMs).

The actual DRM part was left unspecified, with the intention that existing pre-EME DRM codebases can be used with minor or no changes necessary.

EME is now a W3C recommendation

Posted Sep 19, 2017 7:29 UTC (Tue) by ledow (guest, #11753) [Link] (2 responses)

But you cannot sit as a minority party in a committee perpetually wasting time and money fighting against people who won't tell you what they voted, won't give a reasonable explanation why you're wrong and they're right, won't make the slightest concession, and basically ignore everything you say.

The loudest statement you can make that will be heard is "I refuse to participate".

I have personally wasted my time in any number of meetings and committees where it was quite clear that literally nothing would ever change, and it didn't matter how clever, well-researched, persuasive, supported or well-constructed an argument was presented. I was there "to have been there", not to actually initiate any conversation or change. I could have substituted myself with a tub of lard and they would have taken more notice of the tub.

When you're in that kind of position, there is only one option which is to not participate and thus remove your perceived "support" and any semblance of independence and balance that your presence may have implied.

EME is now a W3C recommendation

Posted Sep 19, 2017 10:16 UTC (Tue) by pboddie (guest, #50784) [Link]

It is reassuring to see that some people here understand the dynamics of these situations.

It is a familiar phenomenon: those with power in a certain domain holding "consultation" processes, where input may be solicited from each of the affected parties, but where the intention is to discard or belittle any input that does not validate the already-decided outcome of the process. When such processes are "rubber-stamping" exercises, the value of each participant - particularly that of dissenters - to those driving the process is not in their contribution but in the apparent legitimacy their involvement brings.

This is why people boycott rigged elections, after all.

been there, done that

Posted Sep 21, 2017 2:26 UTC (Thu) by Garak (guest, #99377) [Link]

good stuff

Only FSF turned up to protest against this

Posted Sep 19, 2017 12:11 UTC (Tue) by coriordan (guest, #7544) [Link] (1 responses)

The only organisation that warned about this from the start, and kept warning about this and trying to rally people to campaign against this, is FSF.

They deserve a lot of thanks. At least they tried.

Only FSF turned up to protest against this

Posted Sep 19, 2017 17:22 UTC (Tue) by donbarry (guest, #10485) [Link]

Yes, absolutely. They were a lonely voice in the darkness, but they were and are absolutely correct.


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds