Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal • Hacker News Board

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#141

Post by om2 » Sat, Jul 08, 2017, 4:42 AM UTC

Buge wrote: post #134

om2 wrote: post #115

Earlier quoted context omitted.

I think that is a bit of an exaggeration. First, for some browsers, the DRM scheme is built in, not any kind of plugin architecture. Second, without EME, the state of the art for DRM video was to run the whole playback path through a plugin. Now, only the DRM bit is generally going to be hidden in binary blob (whether plugin or not.) This has some important advantages: * Web content authors can build video players us…

>Video playback only has one code path, instead of totally separate browser and plugin video pipelines. Video codecs are complex, so this means less security attack surface. Nope. For any effective DRM (aka what all browsers use) the video codec decoding happens inside the DRM module. Otherwise anyone could just patch the open source browser and grab the decrypted compressed content coming out of the module. In reali…

In the browser I'm most familiar with the internals of: most of the playback logic is done by shared software, and the decode of the video track is done in hardware in the common case, for both encrypted and unencrypted videos. There are some forks in the path but a lot of commonality.

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#142

Post by kelnos » Sat, Jul 08, 2017, 4:42 AM UTC

syshum wrote: post #138

pvg wrote: post #133

Earlier quoted context omitted.

They seem to care quite a bit. For instance, browser-based DRM and constrained devices have made the experience vastly better than it was just a few years ago. No plugins, you can download content for offline viewing, etc. So I'm not really seeing how they're making it utterly shitty.

Only if you use a Popular Platform like Android or Windows. If you use less popular platforms (Linux, Ubuntu Phone, etc) DRM makes it impossible to access content you paid for. Also if you Root Android, or modify the "approved" platforms in anyway... BAM the DRM kicks you out of your paid for content as well

Sure, but for the vast majority of users, the experience is much better. You can certainly argue that they should care more about minority users such as yourself (and me, Linux desktop user here), but it's a hard sell when the cost of the development and maintenance effort exceeds the revenue brought in.

I don't think there's a great solution here. Content producers believe that DRM reduces copyright infringement to a level that they're at least somewhat comfortable with. Whether that's true or not is irrelevant; it's how they feel about it that matters. Making playback harder for the average customer isn't in anyone's best interests.

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#143

Post by om2 » Sat, Jul 08, 2017, 4:45 AM UTC

chii wrote: post #127

om2 wrote: post #115

Earlier quoted context omitted.

I think that is a bit of an exaggeration. First, for some browsers, the DRM scheme is built in, not any kind of plugin architecture. Second, without EME, the state of the art for DRM video was to run the whole playback path through a plugin. Now, only the DRM bit is generally going to be hidden in binary blob (whether plugin or not.) This has some important advantages: * Web content authors can build video players us…

> same technology stack (HTML5 video+JS) for DRM-ful video as for DRM-free video this isn't a pro in my books - i want DRM to be a difficult and cumbersome stack to use. More specifically, i want the end user to go through hassle to obtain the proprietary plugins, so that the end user feels the hurt from DRM. This makes a non-DRM version much more simple to view (just click and play), so that users would vote with th…

Unfortunately, "Get the browser that makes it harder to watch Netflix! On purpose!" is not a winning marketing message.

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#144

Post by kelnos » Sat, Jul 08, 2017, 4:53 AM UTC

abecedarius wrote: post #118

Fej wrote: post #88

Earlier quoted context omitted.

The one example I have ever seen is Denuvo DRM for PC games, in certain games for (very) limited times. Denuvo has gained widespread adoption among AAA game publishers because it tends to hold for the critical period when a game first goes on sale. The DRM is typically broken within weeks but that is good enough for the publisher, as the release period has generally passed by that point. They made their sales.

I think we should distinguish interactive things like games from the sort of title that's copyable via the 'analog hole' -- for movies/songs/books, effective DRM is incompatible with human liberty, but I don't have that problem with DRMed games. (This isn't to argue in favor of DRM on the web . It ought to stay in its restricted-device ghetto.)

From a sales standpoint, I don't see the distinction. If DRM of movies is broken past the initial sale craze, and the content producers feel they've made their money before it gets broken, then they'll certainly feel that it's been a value-add for their business.

If web-based DRM actually does remove the browser as an attack vector entirely, and the majority of copyright infringement occurs in other places (studio leaks, etc.), then the content producers might see that as acceptable.

Regardless of all that, I think the distinction is more a philosophical one: you seem to believe that the creative output involved in a game is more reasonable to protect than the creative output involved in a movie, just because of the method of consumption. I think the "human liberty" aspect is a bit much, as well: why do you think you're entitled to the content (on "your terms") that someone else has labored to create?

We can certainly argue (and probably agree) that things like copyright terms are effectively unlimited and that's wrong, and even if they were limited, DRM doesn't give you the ability to get at the content DRM-free after copyright has expired. But I don't see it as unreasonable that a content producer should be able to use technical means to protect their content for a period of time after initial distribution. I think the current implementations of DRM leave a ton to be desired, but I think the concept is sound.

I think overall, though, it's a matter of market forces. People consume "pirated" content because either they can't get the content and consume it in a manner that they want to (and feel strongly enough about that to not settle for the "approved" channel), or people pirate things because they believe the price is too high for a legit copy (and then there are those who just won't pay anything at all, no matter what the price). DRM for music purchases has been largely dropped because people are happy enough with the distribution channels and price that they usually don't look for pirated copies, at least not to the extent that makes the content producers nervous. Will we eventually get to the same place with video? I don't know.

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#145

Post by syshum » Sat, Jul 08, 2017, 4:57 AM UTC

soapdog wrote: post #89

What many people that are on the periphery of this discussion sometimes fail to realize is that DRM is already here and already employed by many companies. The current DRM solutions are basically roll-your-own and each company has their own custom stuff which may or may not be vulnerable to attacks and steal/fingerprint the user thus affecting their privacy. This is the current state of things. The EME/DRM spec is a…

>>but this DRM is now running on a sandbox environment

I see this said many times, and it is highly over rated. while Technically speaking yes it calls for a "sandbox" but the need for "Computer Verification" means the CDM has to have full access to the entire system to verify the evil user is not attempting to capture the output. So the sandbox is not really protecting much unless the operating system itself has the CDM integrated as is the case for Windows. So on windows the CDM might be in a functional sandbox but on linux or any other non-proprietary system it is unlikely the sandbox will protect the user from a bad CDM, and given windows track record for security I would not put much faith in their sandbox either.

On the security front I do not believe it has changed much, this idea that the CDM will be more secure seems to be more PR Marketing than actual fact. Further given the refusal of companies to sign onto a Non-Aggression Pledge to protect researchers from DMCA liability it is likely any security issues in the CDM's will go unreported for fear of legal repercussions.

>>>Now, if you're against DRM, instead of complaining about W3C spec'ing it out and browser vendors implementing it. You should stop using DRM content.

Why can a person not do both? Why does a person that has ethical problems with DRM, and view the actual existence of DRM is a threat to their personal liberty be silenced or told to STFU as you have here?

Bad ideas, like DRM, should be continually criticized until they are dead. Vocal opposition as well as monetary boycotts are both valid and should be used to oppose bad ideas like DRM

One of the reason people are opposing video DRM so strongly at the w3c level is we fear it will not stop with Video. Images, Ebooks, Fonts even the web pages themselves are all a target for DRM Supporters. There will come a time that the F12 tools will be useless because the entire page itself is being served via a locked down CDM style plugin. This is just the first phase of killing the Open Web in its entirety

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#146

Post by syshum » Sat, Jul 08, 2017, 5:01 AM UTC

kelnos wrote: post #142

syshum wrote: post #138

Earlier quoted context omitted.

Only if you use a Popular Platform like Android or Windows. If you use less popular platforms (Linux, Ubuntu Phone, etc) DRM makes it impossible to access content you paid for. Also if you Root Android, or modify the "approved" platforms in anyway... BAM the DRM kicks you out of your paid for content as well

Sure, but for the vast majority of users, the experience is much better. You can certainly argue that they should care more about minority users such as yourself (and me, Linux desktop user here), but it's a hard sell when the cost of the development and maintenance effort exceeds the revenue brought in. I don't think there's a great solution here. Content producers believe that DRM reduces copyright infringement to…

>>it's how they feel about it that matters

Yes and that is how a Technical Standards body should be making decisions, based on people/companies feelings ....

That is filling me with Confidence that the open web is in good hands with the w3c...

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#147

Post by kelnos » Sat, Jul 08, 2017, 5:05 AM UTC

indigochill wrote: post #104

metajack wrote: post #74

Earlier quoted context omitted.

For doing without to work, all browsers must agree to do without. As soon as one browser ships it and people prefer browsers that can stream Netflix, everyone else must follow suit or wallow in obscurity. Microsoft and Google make CDMs; no one else had a chance in this fight.

If I follow, you're implying browsers that hypothetically refused to work with Netflix's DRM would wallow in obscurity. While probably correct since the majority of users do seem to like Netflix, others ignore Netflix and get their media through, shall we say more "obscure" sources. Such an obscure browser would seem to suit their needs just fine. Tor Browser doesn't need to be popular among the masses for those who…

I think you're missing the point here: the minority of users simply do not matter. If Mozilla wants Firefox to remain a browser with large market share, it must implement standards that allow DRM. And that's what they want. They don't want to be obscure like Tor Browser. They want to be popular, and they want to have political clout and influence over standards bodies.

That doesn't remove the ability of a minority of users to use something different and make use of the more "obscure" sources, but it does allow the majority of non-technical users who don't care one bit about all this to play the content they want, and in a way that protects their security much better than the old plugin-based approach.

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#148

Post by hopeaboutthis » Sat, Jul 08, 2017, 5:19 AM UTC

izacus wrote: post #131

agentdrtran wrote: post #129

Earlier quoted context omitted.

> i want DRM to be a difficult and cumbersome stack to use. More specifically, i want the end user to go through hassle to obtain the proprietary plugins, so that the end user feels the hurt from DRM. so you want to make stuff like netflix as much of a PITA as possible? why? why be this vindictive?

No, we want to make Netflix pushing DRM as PITA as possible. Video streaming without DRM works just fine. (And please don't come back with "Netflix has no choice BS", they're happily doing all the nasty DRM crap for their own production as well.)

i agree with netflix, straight up. they invest quite a lot in infrastructure and production to provide these videos, and making it simpler for average folks to get their protected videos in a profitable manner is a win for everyone except idealistic pirates. i don't get why i'd care about the needs of the people who want to ruin a fertile ecosystem for some abstract principle.

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#149

Post by kelnos » Sat, Jul 08, 2017, 5:20 AM UTC

emilfihlman wrote: post #31

I don't understand the point of WebDRM. You can't simultaneously give us the content and not give us the content. WebDRM is broken by default and pushing it is just absolutely retarded.

> You can't simultaneously give us the content and not give us the content.

You actually mostly can, today, and "mostly" is good enough for the content producers.

If you have a DRM pipeline that has software and hardware that validates that it hasn't been tampered with (which is absolutely possible with today's technology), then the best an "attacker" can do is point a camera at the display device (and live with the reduced quality that brings), at least not without spending a ton of money on expensive hardware to defeat this.

And as another poster pointed out, DRM isn't really about protecting content from piracy, it's more about content producers having leverage over the people who make content-consumption technology. And it's working quite well for them for that purpose.

Re: Tim Berners-Lee approves Web DRM, but W3C members have two weeks to appeal

#150

Post by AndyMcConachie » Sat, Jul 08, 2017, 5:23 AM UTC

aerovistae wrote: post #41

AndyMcConachie wrote: post #39

I have given money to the FSF for years and will continue to do so as a member. However, I do not support them in this fight. Berners-Lee is doing the right thing here.

Can you elaborate on that? Why do you believe this?

The choice we're faced with is either we get some standardized DRM in browsers or we get unstandardized DRM in browsers. That's the choice.

I've had email discussions with people at the EFF about this and we basically just had to agree to disagree. Their interpretation of the choice we're making is that we either get DRM in browsers or we get some magical fairy-tale land where DRM suddenly ceases to exist. I don't buy it.

Plus, as a Netflix subscriber I don't really mind DRM that much. Feel free to ask away, I'm always willing to talk about this.