Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

The reasoning goes that EME is a standard that specifically allows for attaching a closed-source black-box to the browser in a standardized way. This code is not auditable by outside sources, and therefore could be a breeding ground for malware and exploits (standard open-source philosophy that "sunlight is the best disinfectant"---many eyes on open source software minimizes the opportunities for exploitable bugs to hide). We've seen codec software---even open-source codec implementations---used as an attack vector in the past.

This reasoning, IMHO, ignores the fact that the user-agent still asks for consent, so the user may choose not to allow anything they can't audit. It's just the "Do you want to allow Flash to play this cool video?" story all over again.

The user often does not have a choice because websites that they must use for one reason or another will require these extensions, just like some required Flash. And that's assuming that the extension even works on their system. The extensions are native code IIRC. Ever get a "sorry, your OS isn't supported!" message on a website that you really need to use to get something done? It sucks, a lot. I don't know why the W3C would want to steer themselves in such a direction, it's the antithesis of what the web was supposed to be. The web is supposed to have a well defined set of standards that anyone can implement and use to view the web. This was never true in practice because of things like Flash, but the W3C never endorsed such a thing. Now they are, and that is sad.

Presumably they feel the same way about all closed-source browsers?

Also, the comparison to Flash is not quite right. For example, Flash was an entire black-box, top to bottom, with a runtime, codecs, UI, a JS engine, etc., which downloaded code from the internet to run it.

Web DRM, on the other hand, is a standard that allows for an encrypted video stream to be decrypted. The only differences that I can see between this and the current state of web video are that now the stream can be encrypted. Everything else is still using Javascript, HTML, CSS, HTTP, h.264/265, etc.

The thing that gets me is that open-source browsers are free not to implement this extension if they're not comfortable with (or opposed to) it. The theory is that if companies start encrypting their content then open-source browsers will have to follow suit, but we already have that kind of junk; the difference is that now, with EME, we can keep 99% of the stack open standards, open-source, and auditable, rather than having to rely on Flash or Silverlight to do our decoding.

EME isn't the death of the open web, it's the death of the closed web. It's the death of awful, insecure, and obsolete technologies like Flash and Silverlight by taking the one single thing they're still good for and moving it to the browser. If EME failed and no one implemented it, Netflix wouldn't just stream their content unencrypted; they'd keep using Flash or Silverlight, or maybe implement something themselves so they didn't have to.

Everything that I have read suggests that this is standardizing what has already happened with video, which is a great deal better than the bad old days when companies relied upon Macromedia/Adobe for video streaming. (Or worse, a plug-in from an obscure company with an unknown track record).

As much as I would like to avoid DRM, relatively few producers are going to budge on the issue. The only options are standardized DRM, non-standardized extensions to provide DRM, or simply doing without. None of the options are particularly desirable. This one is likely the best of the three.

Yes, that'll be tasty.