Slashdot Mirror
Hulu Munging HTML With JS To Protect Content
N!NJA writes "Hulu has started encoding the html that they send to people's browsers, and then decoding it using javascript before rendering it. [...] They then run the character stream through a series of javascript functions to convert it back into plain text before pushing it into your browser using DHTML. That's quite a lot of effort just for fun, so I assume that is to stop screen scrapers from parsing content." I really can't understand all this effort. Boxee displayed the Hulu advertising perfectly. I suspect Alec Baldwin is to blame.
they're aliens. that's how they roll.
It sounds like there's something ROT-13 in the state of Hawaii.
...ended at midday yesterday. Though I have to admit that this is far funnier than the "stories" that Slashdot ran at the time.
The XBMC guys already made a plugin after the last hulu change. It'll take a few hours and a new one will be made.
Especially if you SEND the user all the info they need, how hard is it to decode functions? There are crackers out there that take decoded assembly to figure out how to bypass DRM, what makes Hulu think their implementation will be any more difficult?
I mean, the alternative here is to use torrents. Why would Hulu (or their corporate overlords) want to make it difficult to use Hulu, when it's already just as easy to download the show and play it in whatever media center thingamajig I want with no ads?
Couldn't an enterprising screen-scraper also just run it through the same Javascript code? Hulu is forgetting what I like to call the Fundamental Law of DRM: if you make data possible for users to see /hear, it will be possible for a reasonably enterprising user to copy it.
I am officially gone from
TunerFreeMCE couldn't scrape the data. Mission accomplished. Oh, wait... Tada:
"Update- version 2.6.7 is now available to download to work round this new tactic."
And now, I supposed, there will be a DMCA attack as phase two.
I'm all for boxee, but if they wanted aggregates to link to their content I would think hulu would have provided an API to allow it. Maybe instead of trying to work around every change hulu makes they should work with them instead.
My father gave me some HTML that was decoded with Javascript. To get the raw HTML was pretty simple IIRC..
1) Load page in Firefox
2) Open DOM explorer/inspector
3) Export as HTML
4) ???
5) PROFIT!!
The disappearing pencil trick. Let me show you it.
As long as Hulu continues to work with a Linux-based browser, I'm happy. This is unlike ABC, whose system doesn't support Linux at all.
Their loss (or perhaps I should say "They're Lost").
"My country, right or wrong; if right, to be kept right; and if wrong, to be set right." --Senator Carl Schurz (1872)
And to anyone complaining about having to dance through proxies to watch Hulu internationally, it's for the same reasons. What benefit does Charmin see from advertising toilet paper to people in the Netherlands?
All that aside, as someone who has a modded XBOX with XBMC and was living abroad,I can say with experience that all these shenanigans are tiring. Like any arms race where it's content producers vs. the internet, the internet will win in the end.
Maybe they are just doing this to sate the content providers. As long as they appear to be trying to solve the problem, they should get brownie points with the major companies. Considering how popular DRM seems to be with the execs, I'll bet they think this works just as "well".
My webcomic
Make the viewer fill it in every ~2 minutes to keep watching.
Entomologically speaking, the spider is not a bug, it's a feature.
Hulu is owned by Fox/NBC, and they are trying to attract other content providers.
Simply put, the ad revenue on Hulu is much, much less than on TV. Sure, it beats piracy (a little money and control over how long your content is on there) but if people were to cancel cable or watch Hulu on their Xboxes more, both cable/satellite providers and the content providers themselves would be unhappy.
Just another game of cat & mouse: Hulu makes changes, and Boxee updates. The hope is that if you make the workarounds unreliable enough to the point where people are too irritated, most will switch back to TV, with a few using Hulu just online on their computers and a few turning back to piracy.
Why all the effort to apply DRM to free streaming content? Is it just because the networks think that everything needs to have DRM?
This is just more proof that the people who run the big media companies not only do not understand technology, but cannot be bothered to learn it either. If they did, they would realize that DRM is ultimately a futile effort because the end user has to have everything they need in order to decode the content. That means that someone who wants to decode the content to display it in some other unapproved manner, also has everything they need to do it. I'll assume that the technical people/aliens at Hulu know this too and are only doing what the content providers are demanding.
To the making of books there is no end, so let's get started
These guys do understand that nothing prevents me from plugging my laptop into a TV and running a browser on it? And nothing prevents me from plugging a tuner card into my computer and showing TV on the monitor? So regardless of what they do, they can't make something show on a computer but not on a TV?
Wait a minute, my assistant is handing me an envelope he says will explain everything.
(envelope opening noises)
The note inside says "They're total idiots".
Yep, that does explain everything.
I used to wonder why you cannot mod a Slashdot editor's comment "Funny", but now I see that it would be an unused feature ;-)
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Hulu is a BRAND. It wants to live in its own world and be exclusive.
So their attitude is "Frak Boxie", as boxie is trying to DESTROY the brand of all the video sites to be replaced by the Boxee brand.
Why should Hulu play nice?
Test your net with Netalyzr
If you do decrypt it without authorization, they can claim you're in violation. It's not about the technical merits of their solution, it's about the legal aspect.
Won't this also prevent things like Phorm from modifying the ads? A screen scraper can just embed something like Gecko or WebKit and generate the DOM tree with the scripts, but something that needs to sit on a connection and do realtime packet modification like Phorm can't do that.
Since Hulu doesn't work outside the USA, I've never used it so I don't know if which is more likely, but if I had an ad-supported web site I wouldn't want carriers modifying my data in-flight, and this approach is a lot less computationally-expensive on the server side than using SSL without dedicated hardware.
I am TheRaven on Soylent News
And to anyone complaining about having to dance through proxies to watch Hulu internationally, it's for the same reasons. What benefit does Charmin see from advertising toilet paper to people in the Netherlands?
This is where the MBA and Marketing guys are falling down on the job. They should be selling regional ads for international viewers... instead of Charmin, they could sell Nokia ads for Dutch viewers, Weetabix in the UK, and Nutella in Italy, etc...
This is not actually the worst web DRM. I once found a site where the top of the code had a comment that said "Source code not available" followed by a bunch of blank lines. In order to get the source, one just had to scroll down some.
Which, of course, would make the scroll bar an anti-circumvention device.
EUCD is the EU version, if DVD Jon would have been trialed in the EU it would have been interesting. Because I find it very hard to believe that anyone will ever get convicted for circumventing protection mechanisms, if it wasn't with malicious intent, or for monetary gain.
A couple years ago I was on a project building a web site that used asynch calls to web services to get JSON strings and then render DHTML from the resulting objects. The requirement came down that we needed to "encrypt" the data being returned by the seb services. They understood that it would only be obfuscation because the code to "decrypt" the strings would be right there in the JS for anybody to see, but it's what they wanted.
Instead of trying to encrypt it, I chose to compress it. The resulting string was obfuscated so the client was able to check that off the list but more important was that the strings being returned were much smaller and performance was noticably increased even though the string had to be decompressed in JS before it could be used.
There is a lot of talk in this thread about "who do they think they're fooling" and many more people saying "people will just crack the code"
You're right, there will be people out there who crack it. But if you look at it from a statistics standpoint there will be far more people who give up or don't want to take the time to crack it or find the pre-made crack. And vastly more people still who won't try because they've heard about the security and there are easier ways for them to get their content.
It's a numbers game. Especially with you're that "guy with the MBA" that was mentioned above. I think it has nothing to do with him not knowing what he's messing with. He doesn't need to know ... and neither do the advertising investors that are paying him gobs of money. They only need to know the statistics he gives them that says the content is "protected"
NOTHING is ever totally secure ... that's common knowledge. But how your security stacks up against your competitors can make the difference between a winning business model and just another also-ran.
Sure, it beats piracy (a little money and control over how long your content is on there) but if people were to cancel cable or watch Hulu on their Xboxes more, both cable/satellite providers and the content providers themselves would be unhappy.
I already watch Hulu on my xbox 360 and I don't have cable. I run MediaMall's Playon server in a Virtualbox Windows XP image on my Linux machine and it works fine. I can watch cbs.com, Netflix instant viewing content, Youtube videos and a lot of other content with this setup. Oh, and I also stream all my Mythtv recordings (ATSC local broadcast only) to the xbox via Fuppes. It's great. I've always had a deep hatred of cable companies, and it is really satisfying to cut them out and get all this content legally and essentially free (well, Playon is $39, but it is a one time fee). Goodbye to these customer unfriendly companies that are just middle men that add no value.
Simply put, the ad revenue on Hulu is much, much less than on TV. Sure, it beats piracy (a little money and control over how long your content is on there) but if people were to cancel cable or watch Hulu on their Xboxes more, both cable/satellite providers and the content providers themselves would be unhappy.
Very true.
However, this would seem to be the very definition of how the free market is supposed to work. Customers want Internet based television; prefer it over cable/satellite.
Consumers steadily begin to use the net more. Hulu can then begin to charge more for ads while broadcast TV stations lower their rates.
I would think advertisers would prefer Hulu simply because their ads can not be skipped over and users can't just change the channel during the break. That suggests they can charge more for the ads in such a business model since the ads are more effective. End result, less ad volume (compared to broadcast TV) and happier viewers or the same ad volume with more profits.
It seems the cable and satellite TV providers are the ones that lose here but why should NBC/FOX care about them? The cable providers are already in a favorable position as the access point for new media distribution. If TV as a service goes the way of the dodo then they are free to charge more for Internet access provided they ditch the stupid caps.
As long as content providers keep trying to fight customer demand they will continue to miss out on the revenue opportunities that exist. As for copyright infringement, that'll always be around but they can minimize the impact it has by not driving consumers towards it out of an unwillingness to change.
This is probably to stop Lynx browsers from properly displaying content. I'm betting this move was backed by bribe money. Clearly this is aimed at reducing compatibility with Lynx. MS is just trying to steal away market share.
I wouldn't say I have a right by any stretch. I don't. These guys provide the content to me at their discretion.
I think what people are "upset" about is the fact that:
1) Companies (Hulu or otherwise) seriously think that they can control HOW someone access their content. Technology or not, you can't force me to listen to a song on the radio anymore than I can force you to play the song I want to hear. You can't force me to listen to that CD I bought in my car vice my house.
2) People were more than happy to access the content via legal means via Hulu. No one WANTS to pirate anything. It's a pain in the ass. A standard non-HD conversion of a tv show without the commercials over bittorrent still takes in the neighborhood of 30 minutes to download on a standard internet connection. God forbid I want something that is more than a few weeks old.
With Hulu I could sit down and watch the shows on my couch with my wife (when the kid was in bed). Now? Not so much.
The absolutely ASININE part is that users were screaming for this for years. For once, it seemed like the media companies actually GOT it. We were naive. Hulu was working on Boxee for the better part of a year if not longer. It wasn't until Boxee started gaining attention that someone said "You mean people aren't watching this stuff on a computer?"
Let's ignore for a minute how fucking stupid that question is. I *AM* (well was) watching it on a pc. It just happened to be hooked up to a television. What possible idiot doesn't have such a grasp of technology that they don't realize that you can hook a computer up to a television? Who, on the grandiose payroll of the media companies, didn't see this coming?
In the end, they DID hurt themselves. Ad revenues are already down. The company I was laid off from was in the business of television advertising. Between DVRs and P2P, you have a choice. Either provide the content and get at least a sliver of revenue or don't get any at all.
Sure, it may be costing you up front to build support for Hulu advertising among the advertisers but once the ball is rolling, it becomes a more viable outlet for advertising.
Here's the thing. Television advertising is a split bag. Local networks sell ads. National networks sell ads. There's a whole business around brokering advertising spots between buyers and the people with the air time. It's a complex machine. Hulu essentially cut out a few layers of that.
In the end, Hulu was a step in the right direction. Boxee was the "killer application" for Hulu. They really did screw themselves.
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"