The mere existence of Widevine is a mystery for me. How sensible for Netflix is to invest into DRM at all? It's not a gamedev situation, where DRM lasts long enough to make impact on initial sales. Pirated Netflix shows appear on the torrents same day, and unless they have full-stack protection from the decoder to the screen, not much can be done. They seem to make user experience worse for nothing.
Well that investment is pretty low since Widevine is quite easy to integrate and the licensing cost is 0 for Netflix.
The thing is, you do need some Digital Rights Management somewhere. If you just have clear-text mp4 with no auth, you can just share that mp4 url, and you could watch movies directly off Netflix servers (so it would cost even more than torrenting).
You could include temporary tokens in your URLs, but then you need your CDN to be a bit dynamic.
Or you could have a completely static CDN, but the files are encrypted, and you download the encryption key off a server dedicated to DRM that will check you're properly authed. And well, here you've re-created Widevine. Widevine do provide more protections than just that, but that's just free for Netflix, they literally just have to switch some booleans.
> They seem to make user experience worse for nothing.
Yeah I mostly agree. As I mentioned before, there are some usages of DRM that are not completely non-sense. What kills me is the HDCP requirement. Many TVs have HDCP compatibility issues (for instance my Samsung TV has the two 4k60p yuv444 hdcp 1 ports and one 4k60p yuv420 hdcp2 port, so I need to chose between 4k content and true 4k resolution), while HDCP2 is utterly broken: you can find decrypting dongles for 20€ directly from Amazon.