W3C Declares DRM In-Scope For HTML

FredAndrews writes "The W3C has ruled DRM in-scope for their HTML standard. A lot of big businesses have supported advancing the Encrypted Media Extension, including Google, Microsoft, and Netfix. The BBC calls for a solution with legal sanctions. The EME could well be used to implement a DRM HTML engine. A DRM-enabled web would break a long tradition of the web browser being the User's Agent, and would restrict user choice and control over their security and privacy. There are other applications that can serve the purpose of viewing DRM video content, and I appeal to people to not taint the web standards with DRM but to please use other applications when necessary." Looks like the web is becoming more like Xanadu, but not in a good way.

Comments

Reality vs idealism

[Agelmar]

It's so tempting to just sit in the corner and say "DRM is evil, we don't want to taint the web with it" but unfortunately, as is often the case in the real world, we don't get to make decisions in isolation of their consequences. DRM on the web is already a reality, largely using Flash or Silverlight (see e.g. Hulu, Netflix). However, both of these platforms face problems -- Silverlight in particular seems to have a rather uncertain future, Flash availability on tablets and mobile in general is largely non-existant. The poster asks us to "please use other applications when necessary" - is this really a good answer? That is going to lead to even less interoperability, and I would argue it hurts the web at a time when it's already fighting a serious battle against native apps that generally offer developers better control (of UI, no random GC pauses, actual threading models, etc). It's easy to say "DRM will harm the web", it's a bit harder to foresee what the eventualities of telling people "please go away and use native apps" are.

I expect this is likely not going to be a popular response, but in short please realize that this is not as simple as saying "DRM is bad". Yes, DRM sucks but I'd argue that in the long run, having a hobbled web platform losing out to native apps (see e.g. iOS) is going to suck more.

Re:Reality vs idealism

[kthreadd]

Are you talking about iOS apps?

Re:Reality vs idealism

[Skapare]

However, media via Flash or Silverlight is also broken. It doesn't work everywhere and those media executives are just too stupid to figure out a safe system that will work everywhere. They need to find some smart people that know how to make things work and stop push old ideas of trying to control the software in people's computers. It is possible to do.

Re:Reality vs idealism

[foniksonik]

Let me know when you've managed to convince the major OS developers to use a portable container, common SDK and common glucode scripting language.

Re:Reality vs idealism

[Anonymous Coward]

DRM has its place, but we also have to be careful about when and how we use it. For example: I would argue that DRM is valuable for ebook lending (e.g. through libraries). However, it doesn't have a place when the goods are sold (e.g. violates the doctrine of first sale).

In the context of the Internet, we must also be careful. One of the advantages of the current structure is openness. That openness allows adaptability to different circumstances. DRM opposes that because anyone who has the keys can reopen the Internet, so those keys will be carefully guarded. This would result in vendors be marginalized, from the application to the system software level. Not only does this limit options for the market as a whole, it limits options for specialized products (e.g. accessible web browsers, utilities for people who don't have access to broadband due to location/affordability).

Re:Reality vs idealism

[Anonymous Coward]

Indeed. If some idealists are bothered by the "user agent" being controlled by the big media, let's just start calling browsers "media company agent" and be done with it.

Re:Reality vs idealism

[Anonymous Coward]

DRM won't harm the web, it will divide it. See Facebook.

iOS is just a trend, a fading one, otherwise it's percentages wouldn't shift that easy.

Re:Reality vs idealism

[Anonymous Coward]

No. HTML, Hyper Text Markup Language, is a standard for describing documents. It is NOT the place to implement or enforce Digitally Restricted Media(DRM). Other applications already exist for this purpose and new application will also follow that can all be integrated into your HTML document if you insist on using it. But it belongs in an external application, not HTML.

Re:Reality vs idealism

[MickyTheIdiot]

Anything that breaks the cross-platform nature of the web is a breakage of the web. We've got enough shit that does that now.

Re:Reality vs idealism

[Seumas]

The eventualities of telling people "please go away and use native apps" are people saying "fuck you" and not using your site or service at all. I enjoy my iPad, but when a web service/site tries to funnel me into having to use an app to access on a device what I should be able to access with a browser.

And, even if everyone did go along with it, so what? The solution isn't to say "well, garsh, whatever corporations want, that's what we'll decide to include!".

Re:Reality vs idealism

[Anonymous Coward]

DRM being bad is a not a "idealism". It's not some persons *opinion*. It's not like arguing about whether Inception was a good movie (it was).

DRM is faulty *by design*. This is a mathematical truth. And you either accept that truth, or you live in denial. This isn't a "weelllll, it's really annoying for business". Ok, so what? Gravity is really annoying for the American Airlines. Those are the breaks.

The hardware, at the most bottom layer (assembly), has the instruction: mov eax, ebx. This instruction copies data freely. All digital hardware has an equivalent function. You cannot do anything with computers without this basic function.

When you hold a computer, you are physically holding this magical copy instruction. This copy instruction does not know about copyright, or rights holders, or fair use, or DRM, or business models. It simply duplicates a digital value. No computer could exist without it.

So, how do you propose to remove this function, without destroying the computer in the process? It's, ultimately, impossible. You can make things very difficult -- that's fine! Because all you need is one bored determined hacker to break it (which must always be possible, as long as computers exist), and "unlock" the media. Then it will be traded freely.

The only way to stop it is to destroy the computer. Destroy the `mov ax, bx` instruction, that freely copies digital data. But the computer provides so much *other* value, that you can't do that either.

So you just have to live with it. And the sooner you realize that, and realize that this isn't about "idealism", but instead about a mathematical truth that people are living in denial about, the sooner you stop propagating this delusion that DRM is some sort of "solution". It's snake oil. Get over it. I know it sucks. It sucks for me too -- I make music. It sucks. Adapt, or die.

Re:Reality vs idealism

[ByOhTek]

What exactly would you consider a better technology?

Pure HTML is nothing more than an SGML derivative, like XML, and for the use of formatting, is not bad.
CSS, as a way of taking some of the ambiguity and potential for different interpretations on formatting, is also not bad.
JavaScript... OK, yeah, this language could be better. It has a lot of nifty features that can do more harm than good, and is missing one or two nice features (like good type identification, rather than prototype checking, which can have quirks in different browsers).

Everything else is a non-standard and/or proprietary add-on.

Can you think of a better alternative out there that fulfills all the same needs? About the only thing I can think of doing to improve it is replace JavaScript with python (mostly to fix the missing features), Java or C# - and then tweak CSS and HTML a bit to add a few extra features.

By the way, the needs of HTML, as far as I can observe:
To present data on a wide variety of systems, where presenting the data accurately is more important than minor (and even major) variances in formatting, as may be called for by the platform presenting the document(s).

Re:Reality vs idealism

[petermgreen]

Open standards and DRM are fundamentally incompatible. If you know how to decode something to display it to the user you also know how to decode it and save the results of that decoding to a file. Therefore any standard that includes drm will either be trivially broken (see conventional pdf "usage restrictions") or not truely open.

Re:Reality vs idealism

[the_B0fh]

Because you will get royally fucked over. That is why DRM sucks. You will now hand your over identity in order to be able to browse sites, etc. Google, Facebook, etc will now know who you are. Anonymity will be gone forever. Your browser will report on you all the time. Do you know what are web bugs? Do you think the equivalent DRM'ed version will not be there? Except now, because of DRM, it will know exactly who you are.

And don't even think of using different browsers, etc. Because of DRM, you will establish an identity through each of them, or you won't get to use DRM encumbered crap.

Seriously, this is really fucked up.

Re:Reality vs idealism

[Merk42]

How are DRM and cross-platform mutually exclusive?

Re:Reality vs idealism

[the_B0fh]

Also, why do I have to give up my privacy just so that you can get off on your hate of iOS? IF someone wants to give up their privacy and use a native app, that's their bloody business.

Why do I have to use a DRM encumbered web? It won't be just movies or songs or ebooks, it will be used for other things. If someone can put a tracker shit in flash, you think they won't do it with DRM?

Re:Reality vs idealism

[MeNeXT]

DRM is bad especially when it is not disclosed. As an example, I though like you, back in the old DVD days and did not think that CSS was such an issue. The problem was that the DVD not only were encumbered by CSS they also had bad sectors or tracks which created problems for computers. Now the reality was that it also created problems with DVD players which implemented CSS but were a little too old. One day day I bought a Disney DVD and sat down with my kids to watch the movie. It started and would constantly error out. Now thinking that the DVD player was broken I rushed out and bought a new one. The funny thing was that the old one would play all the existing DVDs just fine. Then the second player did the same thing with transformers. I may be slow but I know that's when I realized that there is nothing wrong with the players. What I had to do is scrap the player every 2 years or so in order for the DVDs to work.

DRM prevents the law abiding person to get screwed it does not stop a pirate especially Disney, MPAA, RIAA and such. Where I live you cannot return media when the package is open even when the contents are defective. The laws may not say as much but getting your $20 back will cost more.

Re:Reality vs idealism

[allo]

no, it can be another way. just think of a trusted media path (using trusted computing and a TPM). Then the TPM chip can negotiate a shared secret between your monitor and the site serving the video. then the whole software can be opensource, just as it can with SSL, and it will always see only the encrypted data. In this way, trusted computing is good for opensource, because there is no need for security by closed source (obscurity) anymore.
The only problem ... every company can use this to sell a minimum only, like pay-per-view business models instead of pay-per-download models. But the problem here is the business model, not the tech.

Re:Reality vs idealism

[Agelmar]

The reality of DRM is that, absent having a TPM that enforces some sort of software integrity that reasonably ensures that the player is sending the video to a trusted display (TPM validating OS validating player software validating HDCP connection), you're going to be stuck with some security-by-obscurity closed source components, or "plugins". It's unfortunate but I can't honestly see a way around that without much larger changes (like trusted computing, but in a slightly less evil implementation hopefully). The "better alternative" to native apps then becomes allowing DRM to be done in the browser in the least intrusive manner possible -- that is, use as much of the browser's code as possible and have the plugin footprint be as small as possible. Today Flash and Silverlight are used not just for DRM but for the entire player application, ideally the player application could be mostly in HTML and using the browser's stack as much as possible, calling out to the DRM module only for either decryption or saying "Please composite this decrypted stream into that div".

Re:Reality vs idealism

[Phrogman]

I couldn't agree more. HTML is for marking up the content we want to serve on a webpage. It should not be a means to enforce corporate digital rights, particularly when we have seen other instances where enforcing those rights meant "deny by default". Implementing something like this will require even more monitoring of every web browser. I am already tracked enough by dozens of websites who do so without my permission, then sell the results to corporations.

Re:Reality vs idealism

[Anonymous Coward]

Because cross-platform implies open standards so that everyone is able to implement it on his platform. OTOH, DRM implies a secret component, so that only licensees can implement it. So DRM will only be available on platforms which are popular enough that the implementation pays off the licensing cost (assuming he is even able to get a license). And it will be completely unavailable on open source platforms because it is incompatible with open source.

Re:Reality vs idealism

[h4rr4r]

Because how would they not be?

DRM requires that there is some secret that you do not share with me. This means the implementor would have to port it to every OS and architecture since no one else could.

Re:Reality vs idealism

[Cenan]

That only moves the point in the pipeline where you need to insert code to do the ripping. No matter what scheme is thought up, the end result will always be breakable, simply because you need to output unencrypted content to the end user. You don't even need to break the encryption or do anything at all, all that is needed is to intercept the unencrypted signal before it is presented to the end user. This has been shown time and time again.

Re:Reality vs idealism

[h4rr4r]

If you move the software into hardware that does not make it opensource. Trusted computing cannot be opensource, it must hide data in the TPM.

Re:Reality vs idealism

[fuzzyfuzzyfungus]

The trouble is that the properties that make a DRM system actually useful(ie. some degree of robustness, enough information about their environment to 'rights manage' in some granular way, and so on) require fairly extraordinary powers over the client system.

The 'Encrypted Media Extension' itself doesn't; because it defines almost nothing(one 'baseline' encryption mechanism that is little more than a toy obfuscation system, along with standardization of some interfaces for asking the non-joke DRM module questions); but it is designed to plug into DRM systems that do, which is the only reason that it has any support at all.

Consider, for example, the BBC's little request list:

Unless it is 'sufficiently secure that there would be the possibility of legal action in the event of bypassing it.', no go.

Unless it 'securely identifies a type of device', no go(browser UA is explicitly noted as not being good enough)

Unless it allows 'identification of the context in which the content appears', no go.

And 'The ability to pass further restrictions to the graphics rendering path if available'.

A set of requirements like that is both a fairly stock summary of what a DRM system should be capable of to be worthy of the name and a set of demands that certainly aren't going to be met in any non-tivoized OSS implementation, and wouldn't even be particularly easy to meet on something that isn't a closed box.

Essentially, once the pointless little baseline case is immediately ignored by anybody who would ever actually use the system(since, if you don't want DRM, you won't want the hassle, and if you do, the baseline is far to pitiful to be worth anything), EME is a 'standard' for 'how to use javascript to talk to an entire black-box video rendering mechanism, upon which there will be enough demands that it will almost certainly be platform specific'. Pretty much exactly the same situation as having the video player stuck in a blob of Silverlight or Flash, except that (because this is HTML5, man) the wicked 'browser plugin' has been renamed a 'content decryption module'(which, as the spec notes, 'CDM implementations may return decrypted frames or render them directly, and 'CDM may use or defer to platform capabilities'). In all but name, it's the definition of a few javascript APIs for interacting with a black-box video path more or less identical(if not worse, given the more robust support for invoking the hardware-protected 'platform capabilities' now present on a lot of consumer gear, which something like Flash was always too dubiously competent to do in any serious way) to the plugin-based video player arrangements of the past.

Re:Reality vs idealism

[Charliemopps]

DRM IS Evil. You seem to think that everyone should be able to put anything on the internet without any concern for what happens to it. The internet, at its core, is about the free transfer of information. It's like someone started up a food fair where you could come out and try all these free home cooked meals, learn new recipes, and trade ideas. Then Pizza hut put up a booth. "Hey! All these people tried our pizza and then went out and made it themselves! How dare they!!!"

If you don't want your content downloaded, don't put it on the web. The solution is simple. If you don't want to take part in the new way information works, you don't have to. But to bend this new medium to fit your decades old, outdated business model doesn't just hurt the internet, it hurts your business. There is a lot of money to be made if they just embraced the new system. But they need to be innovative, creative and open to ideas. There are a lot of what were once poor people, getting rich off of the huge vacuum left by big business on the net. They wine and complain that the piratebay founders are making all this money off of people downloading their movies... THINK ABOUT IT! The media industry is driving itself into the ground, and the path to success is clear and laid out before them.

Re:Reality vs idealism

[TractorBarry]

And let's not foget one important thing.

Any series of bytes, of any arbitary length, can be viewed as representing a number. In the case of a file containing (say) 100,000 bytes that's a large number but the point holds that the byte sequence can stil be viewed as a number.

And what's more ridiculous than trying to prevent people sharing a number ?

If that number, represented as a sequence of bytes, can be interpreted by some music playing software to produce sound well... that's just magic :)

Re:Reality vs idealism

[MickyTheIdiot]

It doesn't have to be, but it usually is. I use Linux as my regular desktop OS, and there are PLENTY of things off limits because of bad DRM design or designers that don't care about Linux.

Re:Reality vs idealism

[gl4ss]

are you suggesting we move movie decode to monitors? and then what about the open source browser being tweaked to save the stream to disk and replaying it... and to combat that the monitor would also need to have network - the whole thing would end up being running in the monitor. might just as well buy a tv with a binary only inaccessible properiaty content browser in which case there is nothing open about your content flow. DRM inherently depends on black boxes - sw or hw - and that is incompatible with open systems, be them hw or drm.

the tech is definitely a problem - it's in direct odds with anything open source being in the flow. you can already do crappy drm plugins(silverlight) for your browsers and stream via them(like netflix) so I fail to see what would be the point of trying to put this shit into the general open source portions of the browser.

remember the point isn't about controlling access to the media but controlling what the browser does with that media. and that needs total control over the browser - which means you wouldn't be able to compile your own.

Re:Reality vs idealism

[BrokenHalo]

If we're going to go down the path of the internet being used solely for the purpose of a marketplace, I suspect I will continue my pattern of diminishing usage of it as the years go by. I was there right at the beginning when it was ARPANET and MILNET (and yes, I am even older than that). I understand that DRM has legitimate purposes, but so far, what I have mostly seen is its use to lock in consumers and restrict or deny (I'm looking at Amazon here) legitimate use.

If I am put in a position where in order to purchase certain content, I have to accept DRM encoding, the very first thing I do before I use the file is strip the DRM out. I call this future-proofing, on the grounds that some content providers (Amazon again) have been known to "take back" content, and on the grounds that a digital file should be subject to the same restrictions as a physical book, CD, DVD or whatever.

But I digress: in the earlier years of the internet, I used to spend a (probably too-)large proportion of my life online. Nowadays, having moved away from urban centres and needing to devote more time to getting a life (growing vegies, raising chooks etc) - and with an enforced bandwidth and traffic limit, I find it easier to keep a more distant perspective. So I no longer spend so many hours trawling the net for things hitherto unknown, and actually spend a few more hours at night in bed with my wife.

Re:Reality vs idealism

[Hentes]

My problem is that the W3C has already bit off more than they can chew, so wasting resources implementing DRM is quite extravagant when we still don't have HTML5.

Re:Reality vs idealism

[Anonymous Coward]

DRM is a broken concept. If it is possible to read or display the data anywhere, then it is possible to make a copy of that data.

No DRM schema will ever work, even if you make custom hardware to enforce it. How has custom hardware helped out the XBox? just solder a mod-chip on the motherboard and now you can run unsigned code. as soon as someone else has physical access to the hardware you can't stop them from altering it.

It only requires a single person to break your DRM for DRM free versions of your data to leak out. and many times DRM free versions are available before the official version is even released, meaning insiders were involved, so they can't even secure their own facilities.

In the end DRM is only punishing the honest customers and degrading their experience, it isn't even slowing down the "pirates".

Re:Reality vs idealism

[devent]

No it is possible: with legislation. That is why the BBC is calling for legal sanctions.
This will result in invading your privacy at home just like any DRM:

However, the BBC is unlikely to be able to use any such mechanism unless we feel that it is sufficiently secure that there would be the possibility of legal action in the event of bypassing it.

Television is generally a more expensive medium than music to produce due to the amount of labour involved, and therefore for consumers to purchase. Business models that enable content to be available to them on a temporary (or rental) basis are usually able to do so at significantly lower cost than would be the case for permanent copies.

That is definite not true on the Internet. "Television" on the Internet is cheaper then permanent copies. Once the infrastructure is in place, you just pay for the bandwidth.

An example of this effect in action can be seen with the BBC’s iPlayer – by limiting the window of availability, the BBC is able to make content available for no additional fee to UK licence fee payers.

Yes because the current copyright model is broken. If the copyright terms were not astronomical high, the producers wouldn't be so greedy and would not impose artificial limitations by hiking up prices for unlimited availability. That is the only reason public entities like the BBC needs to artificial limit availability. There are no real cost in making a video available once or unlimited on the iPlayer.

We require the ability to securely identify a type of device, and enable or disable video playback based upon the answer.

Goodbye free operating system and free browsers. I can see a future where Mozilla needs to negotiate a license with the BBC (or any other producer) to be able to play their videos.

The ability to pass further restrictions to the graphics rendering path if available.

Goodbye your privacy, goodbye open source. Now every component needs to be verified that it is "trusted".

Instead, the high-quality video content that the broadcast industry produces will be made available only to closed devices and application stores where such security can be implemented.

It's just the same anyway. Either you close up the Web with DRM or you use closed solutions like Flash or Silverlight. What is the advantage for the Web again? There is no way under those conditions from the BBC that an open source browser like Firefox or open source system like Linux can operate.

Re:Reality vs idealism

[AvitarX]

But if the browser is allowed to be open, then you've defeated the DRM.

the way I see this playing out is no movies or newspapers on Firefox or chromium. Google stands to save how much money with this? I imagine a large percentage of the people will go to chrome.

if the DRM is supposed to be any more effective than the no right click style JavaScript, its going to destroy the open source browser eco system. If It's simply meant to prevent the most casual of copying (this is actually what I think is a valid use of DRM, as realistically content is gonna get out anyway), then your plugin idea works, but good idea selling that.

Re:Reality vs idealism

[bWareiWare.co.uk]

So I can just make my own TPM chips based on the standard right?

Re:Reality vs idealism

[devent]

PS: Of course Richard Stallman was again all correct about cloud services: Cloud computing is a trap, warns GNU founder Richard Stallman

Now the DRM from the cloud services will be standardize. That will give legislators only more excuses to push such laws as the DMCA, SIPA or SOPA. "The proposed law will only make compliance with the W3C Media Source Extensions more easier. You do want your Youtube videos, no?"

Re:Reality vs idealism

[devent]

That will all be changed by brain implants. Now we can ensure the trusted path: Internet, local Computer, HDMI connection, Monitor, Eyeballs. The monitor will output an encoded picture that the eyes will register and the brain implant will decode it to your occipital lobe Later it will erase any memory of the video if the producer set the broadcast flag.

Re:Reality vs idealism

[jellomizer]

Back to Gopher!

Re:Reality vs idealism

[Transfinite]

Whilst I agree with the sentiment of not polluting HTML with DRM, we all know that it will be broken withing days anyway. I do not agree that HTML is 'now' only just a standard for describing documents. I't gone way beyond markup, as demonstrated by HTML5. There 's much to be said each way on this.

Re:Reality vs idealism

[Transfinite]

:) Even if you try to stop them you can't. Would have thought we would have learnt from the past, for example what Gödel Numbers did to the ivory towers of Principia Mathematica? http://en.wikipedia.org/wiki/Principia_Mathematica

Re:Reality vs idealism

[serviscope_minor]

I understand that DRM has legitimate purposes,

No it doesn't.

What it does is annoy the paying customer and serve as no impediment to the pirate.

Re:Reality vs idealism

[jellomizer]

Digital media has brought on new problems.
Creating quality content is still expensive. Mass distribution is easy.
So we have good old economics 101 of Supply and Demand. With Digital Media Supply reaches a level so high that Demand has barely any effect, and the price per unit is 0. So 0 times any number is still 0, which is less money then it makes to create the content.

Pre Digital media we could control this. Books required to be printed, Music on records or tapes. If you were to mass Pirate books or Music without serious loss of quality you would need an expensive operation. Sure we had tapes of songs from the radio or copies of the tapes, however the quality to copy a copy degrades with the analog copy. Not so with digital, every copy is exactly the same as the previous. Meaning we can cheaply make copies ourselves and mass distribute them over and over.

DRM is a way to limit the supply of digital media, so its price won't fall below where they can make profit. Yes I bet some of you Anti-Capitalist say Profit is bad and Greedy and evil and all that stuff... But plainly put, without profit it is near impossible to have the resources to continue on providing your goods.

RMS is right, Data wants to be free. However making the data isn't free, and the army of volunteers doesn't always work for every project.

Re:Reality vs idealism

[NatasRevol]

Goodbye your privacy, goodbye open source. Now every component needs to be verified that it is "trusted".

Only if you want to watch their movies.

Re:Reality vs idealism

[jellomizer]

DRM isn't fool proof. However it is a case of keeping the honest, honest.

How much work are you willing to do to watch that movie for free where you can pay a $10 a month subscription or rent it for $2.00?

Is it worth trying different patches made by people of questionable ethics, perhaps having to rebuild you OS every once in a while until you find the good patch.

Are you willing to solder a chip to your hardware, risk breaking it?

Re: Reality vs idealism

[drakaan]

The funny thing about this idea is that even if the server side of the web decides to implement some fancy new DRM scheme baked into html, DRM proponents can't be sure that all user agents will care. They'll either deny access to non-conforming agents or have ineffective DRM, at which point users will have a starting point for bitching about inaccessible content, just as they did with Apple and iTunes content (or no reason to care, if the restrictions can be bypassed).

This is a near universal "donotwant", so while certain interests may succeed in getting DRM included as an aspect of a document markup specification (*sigh*), that doesn't mean users will accept it or desire it or be happy about it or shut up about the problems it causes. Making noise now serves to signal that there will be problems down the road when everyone realizes what the hell is happening.

Re:Reality vs idealism

[jellomizer]

iOS is a trend. However the idea of low end cheap apps are still growing. A lot of them are in essence just a webbrowser with a couple of security features implemented in it.

Re:Reality vs idealism

[mwvdlee]

DRM hurts paying customers and merely temporarily inconveniences non-paying users.

Re:Reality vs idealism

[erroneus]

Yes... move the bad [DRM] into HTML and into the browser. We can then more easily write a Firefox patch and/or plugin to suck down DRM'd content.

We know that DRM is unpopular with users and that the first adopters are also the first droppers. DRM'd music formats already a thing of the past are they not? It amazes me that DRM'd gaming still persists.

DRM in HTML standards can never be effective and can certainly be more easily circumvented. So I say "go ahead, do it." It just makes things easier.

Re:Reality vs idealism

[Catbeller]

Our browser engines will now become secrets. Cracking those secrets will be a felony worldwide.
This is the end of the world wide web. The network is now a commercial sanctuary, guarded by businesses for businesses.

I never understood why banks and such were even allowed to be on the web. It was obvious then, and now, insanely obvious, that they would envelope and digest the protocol, and make it their own. They should have stayed on their own closed lines. The web was not designed for secrets.

Except now, it will be.

Re:Reality vs idealism

[manixrock]

Implementing DRM is no different than implementing platform-specific features, except instead of platform-specific they are server-specific, which is even more restrictive. The competition with apps is the same as the competition with Windows-only applications, and the open web won.

Shame on the W3C for even considering this. The internet was made open for a reason, and it is no small feat to keep it this way in the face of powerful interests. People want information to be free, and it will be free, whether by a return to common-sense decisions by the W3C, or by its abandonment for a more sensible alternative.

Re:Reality vs idealism

[devent]

Do you really think once DRM is in place in every browser and is a W3C standard, it will only be used for movies?
I could think that Google, Facebook, Twitter, Dropbox, Amazon Cloud, etc. are perfectly able to leverage DRM once it is in every browser.
Facebook is already claiming all pictures of you as theirs:
Facebook to sell your photos: Social media giant claims it owns the rights to ALL your Instagram pictures

The only obstacle right now is that to enforce DRM you need to use Flash or Silverlight. But once you open up the floodgate...

Re:Reality vs idealism

[devent]

PS: Also you are paying for DRM either you are using it or not. HDMI, DVDs, DVD players, TVs, mp3 players, etc. all implement DRM and you are paying for it.

Re:Reality vs idealism

[gutnor]

Not really, the weakness of most DRM platform is that they can be used offline. Meaning that the key to decrypt the content is yours and common to a lot of people. Secrecy is necessary for those algorithm to prevent hacker to find the key too easily.

On the other hand, constant connection to the internet is a perfectly reasonable limitation for streaming over the internet. It is therefore possible to generate a unique encryption key for the content streamed to you that you retrieve from a license server using PGP. Basically, quite similar to HTTPS and perfectly doable with public algorithms.

Re:Reality vs idealism

[tepples]

That or people will end up choosing a particular platform because it supports the DRM. That's what video game consoles have done for decades with exclusive titles, and that's what Amazon is trying to do by restricting Kindle Owners Lending Library books and Amazon Prime videos to work on Kindle Fire and no other Android tablet.

Re:Reality vs idealism

[sootman]

Or, as Bruce Schneier so briefly and eloquently put it, "Trying to make bits uncopyable is like trying to make water not wet."

Re:Reality vs idealism

[GameboyRMH]

I would rather the DRM stay in Flash, Silverlight and other dying technologies and refrain from tainting the HTML standard.

DRM has no place where technical competence exists.

Re:Reality vs idealism

[NewWorldDan]

You're missing the point here. Google and Microsoft certainly that making perfect DRM is impossible without controlling the entire hardware and software stack. That's not the goal. The goal is to make casual copying sufficiently difficult. The secondary goal is to shut as many competitors out of the marketplace as possible. Because any realistic DRM will require OS level security to be effective, they can shut Firefox and Opera out. It's a classic example of rent seeking, only it's going through the W3C instead of a government.

Re:Reality vs idealism

[bzipitidoo]

DRM is 100% nonsense. Such schemes are bait for suckers who persist in thinking that ideas and laws for material goods are applicable to data, the ones that use the term "intellectual property" disingenuously. Of course authors deserve compensation. But being fair to content creators does not mean we should accept costly measures to prop up business models that are clearly broken. Abandon the Internet? Submit to inspections by piracy police paid for by ourselves? Ridiculous! The honesty most lacking is not the people's, it's the proponents of these copy protection schemes.

How much work are you willing to do to watch that movie for free

You're thinking of it wrong. It's not how much work any one person is willing to do, it's how much work we all are willing to do. Amortized over a world population of about 7 billion, the amount of work required to break DRM is trivial. Only takes one crack to break the DRM for everyone.

Is it worth trying different patches made by people of questionable ethics

The people with the more questionable ethics are the ones trying to impose DRM. I'm more worried about what their unpatched software does than the viruses that could be present in cracks. Remember the Sony BMG rootkit fiasco? The Turbotax boot sector mod? Windows Genuine Advantage, particularly the false positives it raised against legitimate installs? Ernie Ball's experience with the BSA? And once again, you're looking at it wrong. How long can a crack with a trojan go undetected? Only takes one person out of those billions to discover the problem. As soon as it's found out, it's game over for that trojan.

Are you willing to solder a chip to your hardware, risk breaking it?

I'm not willing to buy that hardware in the first place.

Re:Reality vs idealism

[h4rr4r]

Which is even worse. It means I will either be wasting money on redundant devices or deprived of things I am paying for. Like your last example and my having prime but no way to watch videos on a tablet.

Re:Reality vs idealism

[K. S. Kyosuke]

DRM isn't fool proof. However it is a case of keeping the honest, honest.

I'm afraid that has very little to do with honesty (if anything at all), and much more with convenience.

Re:Reality vs idealism

[Dusty101]

Parent poster is less insightful than (s)he thinks (s)he is. However, I appreciate them taking the time to present the argument, so I'll take the time to try to provide a reasoned rebuttal.

Yes, the content companies are still going to continue to try to push DRM on the world, but that doesn't mean that it's:

(a) not fundamentally a broken design (see the many, many arguments elsewhere on the web as to why DRM is fundamentally a "security by obscurity" approach, possibly modulo uber-draconian TPM approaches),

(b) something that needs to be inflicted on *everyone* at the web infrastructure level &

(c) something to be passively accepted as inevitable.

If a large subset of web users want to watch DRM-encumbered "Gossip Girl" streams, they're free to use something like Flash or Silverlight that's added on top of HTML specifically for that purpose. Right now, as an end-user, I can choose to use or not use such things, but I don't want this baked into the HTML standard itself.

If someone comes up with a proprietary, protected media delivery system that's actually good enough in terms of performance to work for the general consumer crowd, then fine. If it's more stuttery rubbish like we have now, then so be it: it clearly doesn't cut the mustard anyway. Note that I type this as someone who only last night ran into exactly the problems mentioned here: the preceding ad on the website would play, but the video I wanted to watch wouldn't.

Stuffing everyone into the same DRM straitjacket at the HTML level just makes no sense from the user's point of view (but plenty of financial sense for the media companies, who can then impose restrictions on *everyone* at once, even if they have no interest whatsoever in GenericMediaCorp's output). Personally, in such a world, I'd probably just use two browsers anyway: one that doesn't support the DRM extensions for most of the stuff I want to actually do, & one that does, just for watching the occasional DRMed video. So it's functionally equivalent anyway, in that I have the Silverlight plugin installed, but I think I've only used it three times in as many years.

So yes: "please use other applications as necessary" *is* the better answer, as it at least allows users to vote with (the electronic equivalent of) their feet. The most obvious example of this is that the drop in Flash video popularity in the last few years can't be entirely unrelated to its exclusion from iOS devices, for example. A fragmented market for DRM on the web is a *good* thing for end users.

Re:Reality vs idealism

[kbg]

The problem with DRM is that the fundamental problem is that it is impossible for it to work. Ever! You can't limit content from the same user that you also wan't to show the content to. So therefore DRM is evil and totally useless and should never be used period.

Re:Reality vs idealism

[Cenan]

Even controlling the entire hardware and software stack is not enough. I agree that it would be a signifacant obstacle, but no more than that. You're still outputting un-DRMed content to the end user, and even if Google produced a TV that supported whatever scheme they cooked up, you'd still have to output pictures on it. And if you do that, you've lost the battle.

Re:Reality vs idealism

[TheRaven64]

And then what? My browser gets a key, it decrypts the media, and it dumps it to a file. What has the DRM accomplished, other than to burn some cycles (and, hence, battery life) on my mobile device?

Re:Reality vs idealism

[jbolden]

It is not banks that are driving this. What banks what is generic HTML with security. Brokerages pretty much the same. Banks want your session to be secure, they are very well setup for securing their network against you.

Consumer entertainment is what is driving DRM.

Re:Reality vs idealism

[jbolden]

Any number can be represented by a series of letters. We've been copywriting series of letters for centuries.

Re:Reality vs idealism

[Microlith]

it is a case of keeping the honest, honest.

So punishing the honest while doing nothing against the dishonest.

How much work are you willing to do to watch that movie for free where you can pay a $10 a month subscription or rent it for $2.00?

For those willing, all they have to do is wait. Eventually it will be released sans DRM.

Is it worth trying different patches made by people of questionable ethics, perhaps having to rebuild you OS every once in a while until you find the good patch.

If I'm forced to use an OS I cannot trust, then probably.

Re:Reality vs idealism

[bws111]

Yes, you can. Of course the signing key is not part of the standard, obviously. So you would need your own signing key, and until you can prove that your TPM is functioning correctly nobody needs to trust your key.

Re:Reality vs idealism

[IamTheRealMike]

How has custom hardware helped out the XBox? just solder a mod-chip on the motherboard and now you can run unsigned code.

Actually, mod chips like that were impossible to create for the bulk of the 360s existence, and measurements of piracy rates of the same game on 360 vs PC showed that piracy was dramatically less of a problem on the console platforms. So presumably it paid off for them.

Oddly enough I was just talking with my brother about this problem yesterday. He sells high end music sample libraries. He worked hard on the last release and the sales more or less pay his rent, which takes the pressure off for his main job (contract music production). Unfortunately for the sampler that he targets the copy protection was not very good and recently got cracked. It's very likely that his sales will now fall to the point where his rent is no longer reliably covered. He was asking me what it'd take to make a competitor to that sampler tool and the main competitive advantage would be stronger DRM. Sample libraries at that level require fairly complex programs to make them work so a form of always-online authorization could feasibly work (I have a fair bit of experience in software obfuscation). Now whether anyone will actually do it, hard to say, but the frustration the people in his industry feel about this is very real. Everyone knows no DRM will last forever, but whilst it does, it sure does help put the mind at ease.

Re:Reality vs idealism

[Alsee]

It's a cute quote, but wrong.

It's easy to make water "not wet", simply heat it into to 500 degree vapor.
On the other hand trying to make bits uncopyable is stupid and impossible.

-

Re:Reality vs idealism

[JD-1027]

This quote really loses it's effectiveness up north in the dead of winter. That is, unless you consider that lovely three foot snow drift "wet".

Re:Reality vs idealism

[ByOhTek]

Well, neither did the person I was replying to.

Bad, in this sense is:
Does it not perform the desired task?
Is it difficult to use?
Is it inefficient?

I'd have to say "no" on the first 2, and for #3, only in terms of space, and that's just so it can be easy to use without special tools. Could it be better? Sure, a bit of math so you can have formatting that handles multiple length specification types would be nice. better compatibility (less 'independent additions') between browsers would be nice too.

Re:Reality vs idealism

[Digital Vomit]

However it is a case of keeping the honest, honest

Ah, that old canard.

An honest person is honest because he is honest. He doesn't need anything to keep him honest.

Re:Reality vs idealism

[NatasRevol]

That's a hell of a leap you take there:
DRM on media leads to DRM on the entire web.

That could have been done 5 years ago with Flash, but wasn't. Why would it be now?
Does the fact that Flash is embedded in Chrome mean everything, or even just Google, is going to be DRMed? No.

Take off the tinfoil hat.

Re:Reality vs idealism

[scrod]

having a hobbled web platform

That phrase is redundant. Native apps (especially those that the user can compile and run him/herself on his/her own machine), will always provide more freedom and control than anything running on someone else's web server, or inside some sandboxed browser environment. Your view of pushing for the web application is entirely in conflict with giving users more control —and I suppose it should come as no surprise that you're willing to advocate for DRM, too. Get your priorities straight.

Re:Reality vs idealism

[vux984]

An honest person is honest because he is honest. He doesn't need anything to keep him honest.

Maybe. But we're talking about regular people not saints.

There's an awful lot of regular people who used napster, kazaa, and so forth. As those got shot down, a lot of them switched to convenient legal alternatives spotify, itunes, etc.

You can call them all dishonest people if you want. But the "old canard" about keeping honest people honest is really meant to apply to people like that. Most of us count them as honest people because they aren't exactly sociopaths and criminals with no regard for their fellow man... but if they can download something for free, nobody is visibly harmed, and its effortless then they will.

Make it just a little bit hard though, and they'll take the easier legitimate option.

Re:Reality vs idealism

[Anonymous Coward]

I wouldn't even trust the 'trusted' keys. Their only purpose is to transform my computer into a useless hunk of garbage. 'Trusted computing' is simply insane, useless, and evil.

Re:Reality vs idealism

[AmiMoJo]

By definition you can't have a "safe system" that works everywhere. All DRM requires some secrecy at some stage, making free beer and open source implementations difficult.

The current philosophy seems to be to make the DRM less annoying until a balance is found between restrictiveness and people's willingness to buy it. Netflix and Hulu are good example - annoying and unusual for lots of people, but apparently enough are okay with the limitations to pony up instead of heading to the Pirate Bay.

Re:Reality vs idealism

[AmiMoJo]

Such schemes are bait for suckers who persist in thinking that ideas and laws for material goods are applicable to data

Actually that would be a lot better than what we have now. If I buy a chair it's mine to do what I like with. I can modify it, sit on it backwards, sell it to someone else, make copies myself. The carpenter who made it can't take it back, can't charge me on-going fees to sit on it, can't break into my house and smash it up because his license to the design ran out, can't prevent it being used in public etc.

Re:Reality vs idealism

[lister king of smeg]

The difference is fundamentally that Linus lets me copy and share his numbers that is Linux, and asks that we all share them nicely. Where the MPAA want me to pay to view the numbers but not let me copy share alter or play with them. We are defending copyleft as Richard Stallman calls it, the right to do what you want with the numbers, to share alter use and make your own, and not have them locked away from you that the copyright of the MPAA uses.

we defend the right to share
we fight the limitation of our rights to do so.

Re:Reality vs idealism

[lister king of smeg]

Computers also have memory protection which prevents an application from copying data from another application. Is that feature "faulty by design" too? When the kernel prevents a user-space application from corrupting important internal data structures, it subverts the function of your almighty mov instruction. Is that also a fault, then? When hackers "get root" that's seen as a fault in the OS, but by your logic in fact the fault was just that the OS made it hard for him. Ridiculous.

How you can put a huge fucking value judgement on how computer software is "supposed" to work and then pretend you're just stating mathematical truth is beyond me. Clearly you have no fucking idea what the words "mathematical truth" mean, and are so full of your own opinions you actually believe them to be fact. In other words, you're the worst kind of narcissistic wannabe-alpha-nerd. Good luck with that.

those help the operator of the device drm hampers the operator.

Re:Reality vs idealism

[westlake]

No DRM schema will ever work, even if you make custom hardware to enforce it. How has custom hardware helped out the XBox? just solder a mod-chip on the motherboard...

Which is a skill almost no one has.

67 million Xbox 360s, 64 million PS3s, 96 million Wiis

No one loses any sleep over the occasional hardware mod except the geek who was arrested after he made a business of the thing.

Re:Reality vs idealism

[AuMatar]

And a lot of them aren't. You can get a much cleaner, better UI in a native app than HTML, and you don't have to deal with the horrible GUI editing language that is XML or the utter pile of shit that is Javascript. So the user and programmer get better experiences. Native apps are always better, its just a matter of if its worth the cost to make one.

Re:Reality vs idealism

[tyrione]

What exactly would you consider a better technology?

Pure HTML is nothing more than an SGML derivative, like XML, and for the use of formatting, is not bad. CSS, as a way of taking some of the ambiguity and potential for different interpretations on formatting, is also not bad. JavaScript... OK, yeah, this language could be better. It has a lot of nifty features that can do more harm than good, and is missing one or two nice features (like good type identification, rather than prototype checking, which can have quirks in different browsers).

Everything else is a non-standard and/or proprietary add-on.

Can you think of a better alternative out there that fulfills all the same needs? About the only thing I can think of doing to improve it is replace JavaScript with python (mostly to fix the missing features), Java or C# - and then tweak CSS and HTML a bit to add a few extra features.

By the way, the needs of HTML, as far as I can observe: To present data on a wide variety of systems, where presenting the data accurately is more important than minor (and even major) variances in formatting, as may be called for by the platform presenting the document(s).

Considering the Browser is written in C/C++ I think a standard Media Library fully open in C/C++ with clean hooks via HTML 5 and it's Media methodology would be just fine.

Re:Reality vs idealism

[Jeremiah Cornelius]

DRM is evil.

It is also algorithmically impossible. The Bob, Carol, Alice problems never work.

Re:Reality vs idealism

[Jeremiah Cornelius]

Destroy rent-based models for business revenue.

Do it for your children.

"Central Services - we do the business, you do the pleasure..."

Re:Reality vs idealism

[KiloByte]

All DRM requires some secrecy at some stage, making [...] open source implementations difficult.

s/difficult/impossible/

To display the content, you need to decrypt it into an understandable form. This means, the authors would need to add an antifeature to deny some forms of use if a flag is set -- removing such an antifeature is trivial so no one even bothers.

Effective DRM is, strictly speaking, impossible even in closed source, but the bad guys can least make it hard to pierce.

Re:Reality vs idealism

[KiloByte]

Constant connection does nothing to restrict non-interactive content. If a human can see it, a machine can store it. You just need to capture the data at any point after decryption.

Re:Reality vs idealism

[KiloByte]

You'll just add another implant at the very next neuron after the first one.

Re:Reality vs idealism

[marcello_dl]

In other news, the police arrested and raided the home of a certain Jeremiah Bornelius, terrorist.

Re:Reality vs idealism

[gutnor]

And then what?

And then what, what ? That's a DRM, it does what other DRM do. This one will just run on the browser and os of your choice.

Re:Reality vs idealism

[NatasRevol]

And yet the following websites do just that:
netflix
hulu
youtube
every newspaper using brightcove

Re:Reality vs idealism

[Jeremiah Cornelius]

That's just not cricket.

Re:Reality vs idealism

[Catbeller]

Banks and entertainment giants. "And such". It was originally a longer list, but I'm trying to self-edit my wordiness.

The entertainment giants had cable - dedicated lines. They should have stayed there. Once they get into the standards, we've lost the open web.

Freedom, when it comes to such as browser code, is an absolute. You cannot be just a little bit unfree.

Re:Reality vs idealism

[NatasRevol]

Yeah, because the whole point of netflix, hulu and youtube isn't videos. Or something.

What exactly are you arguing about?

Re:Reality vs idealism

[aaron552]

I don't think you understand asymmetric encryption. You need the "secret" key to decrypt data. The public key is not secret and is only used to encrypt data. DRM require the user to have the "secret" private key on their computer, but not have any form of access to it themselves, and no way to capture the decrypted data.

Re:Reality vs idealism

[aaron552]

Computers also have memory protection which prevents an application from copying data from another application.

I'm pretty sure this is false. Memory protection prevents programs writing to another application's memory space. That's providing data integrity, and in no way prevents copying.

Re:Reality vs idealism

[aaron552]

mp3 players

MP3 does not include any form of DRM. Sure, any MP3 player that supports PlaysForSure or iTunes has some for of DRM on it, but mine does not support either.

Re:Reality vs idealism

[aaron552]

Last I heard, the iPad had well over 80% of the tablet marketshare in the US

Re:Reality vs idealism

[EdZ]

Sure, but you still end up with decrypted content at the client end, so it's just as vulnerable as having the key stored locally (and you'd still have to cache it locally anyway).

Re:Reality vs idealism

[EdZ]

Then you break the path of trust at the unencrypted end of the BCI chip.

Re:Reality vs idealism

[strikethree]

I will not participate. Good luck with the DRM. Cheers

Re:Reality vs idealism

[strikethree]

DRM isn't fool proof. However it is a case of keeping the honest, honest.

I would argue two things against this:

No, it is not a case of keeping the honest, honest. It is a case of lock-in and rent seeking disguised as keeping the honest, honest.

The second argument is that the current rules are not a fair deal anyways. I refuse to fucking pay someone to sing Happy Birthday and I resent the fuck that the traditional childhood song is no longer able to be sang. What. The. Fuck.

Fuck every single one of you who supports this fucking insane system. I refuse to participate.

Re:Reality vs idealism

[Pieroxy]

Let me know when you've managed to convince the major OS developers to use a portable container, common SDK and common glucode scripting language.

Don't hold your breath though, or the joke is on you.

Re:Reality vs idealism

[Pieroxy]

You didn't get DRM at all apparently. It's not a matter of ME willing to solder a chip to my hardware, it's a matter of someone, ANYONE, willing to do so and then seed the movie on BitTorrent.

All it takes is ONE person breaking the DRM, and the entire DRM is defeated for EVERYONE because it becomes simpler to download the movie on TPB.

Re:Reality vs idealism

[IamTheRealMike]

Yes, you are. The samples were recorded by the people who made the sample library. So your point is invalid.

Re:Reality vs idealism

[allo]

thats like saying "gpg cannot be opensource, because you need to hide your key".

Re:Reality vs idealism

[allo]

no, its not decoded in the monitor, but by some trusted piece of software, which is certified just to decode and forward, and not to save it to the disk.
And there are ways to protect against replay-attacks.

Re:Reality vs idealism

[allo]

of course, you can try to rip the display signal short before the tft-panel. But this is much harder to rip than just saving a movie file. you will also need to re-encode it and have some quality loss. It will certainly make ripping much harder.

Re:Reality vs idealism

[allo]

yeah, it would have flaws. But assume its there, then it could be used with opensource software as controller. No need for closed source to provide restricted access.

Re:Reality vs idealism

[AmonTheMetalhead]

And before napster those same people copied tapes from friends and such. Piracy existed before the Net.

Re:Reality vs idealism

[AmonTheMetalhead]

I know the solution: Implants!

Re:Reality vs idealism

[AmonTheMetalhead]

Regardless of the technical merits (or lack thereof) of your statement, you can still hack the monitor and steal the data stream there. DRM CAN NOT WORK. PERIOD.

Re:Reality vs idealism

[AmonTheMetalhead]

Casual copying has gone the way of the dodo in 1998 when Napster came about. It's easier (and faster) to click on a magnetlink and download a torrent than to make your own copy. DRM doesn't work. And Trusted Computing isn't about the content but about platform control.

Re:Reality vs idealism

[AmonTheMetalhead]

Wouldn't work. Hell, you could just grab the raw data that's sent to the TFT panel if you were so inclined.

Re:Reality vs idealism

[Digital Vomit]

However it is a case of keeping the honest, honest

An honest person is honest because he is honest. He doesn't need anything to keep him honest.

Maybe. But we're talking about regular people not saints.

My mistake. I thought we were talking about honest people.

Re:Reality vs idealism

[devent]

Yes that's the fallacy of DRM. At some point you have to decrypt the content.
Yeah you are right. If the path can go: Computer -> BCI chip -> Brain, one can shortcut it to Computer -> BCI chip -> Computer.
But you do not own your hardware and the software, you can't do that.

That is what all DRM is pushing for: to deprive you of your property. Only if you don't own the software or the hardware you are using in your home can DRM work. Of course with software it's easier: you don't buy a copy of the software, you are just license it.

Re:Reality vs idealism

[h4rr4r]

Not at all. GPG can be open source, the key is yours to make and do with as you like. With DRM you are given a key you are not allowed to see or touch.

With GPG you can easily hand it an encrypted file and get back the clear text. With DRM you cannot do that, or it would be pointless. Their has to be some hidden from you way that this software can talk to the display else you could just record the output of the DRM package. If it ever gives you the key or the data in the clear it is not effective DRM.

Re:Reality vs idealism

[allo]

you're not understanding my postings. GPG is opensource, your private key is not. A program reading a encrypted video-stream and forwarding it via a trusted path to the graphics card can be opensource, the key inside the tpm/graphics card/monitor cannot. so trusted computing enables opensource DRM, while the current situation requires closed source to implement a DRM-System.

Re:Reality vs idealism

[allo]

the final hack is a camera in front of the monitor. But the quality will be lower and/or the methods will be more complicated. So you can at least limit everything, which happens in software. While still using opensource software.

Re:Reality vs idealism

[h4rr4r]

I understand just fine. You are trying to play games with words.

If this DRM was opensource, then why can't I modify it to just bark the output into a file that I can play back later?

You know, just like I can do with GPG. Sure you can show me the source to this application so I guess for some definition it can be open, but it can never be modified or Free software. At the very most it can be used to ask the DRM to send the info to the screen. Which makes it as useless as tits on a boar hog.

Re:Reality vs idealism

[allo]

what i mean is: If your hardware is closed, your software may be open. Which is quite a big ADVANTAGE, if you're a free software developer, who just wants to provide cool software. Its still a big problem, if you're the customer wanting to use the media in any possible way (your good right, imho).

Re:Reality vs idealism

[h4rr4r]

It is no advantage if you are not devoid of all morality. If you just want to provide cool software you might as well not make it opensource, then both the hardware and software can conspire against you.

Make those with the money pay

[Anonymous Coward]

It seems like it should be incumbent upon those that want to restrict your freedoms to bear the full burden of that cost. That is, we do not help them develop a standard for this, and force them to do all the work necessary for their restrictions to try to propagate in the browser ecosystem via plugins, extensions, custom applications, etc.

I would never go so far as to restrict *their* ability to do so, but we should never EVER encourage such behaviour in open standards.

The standards committees should be spending their time (and money) developing technologies that would help people, rather than hinder them.

BBC not calling for legal sanctions

[AmiMoJo]

The BBC is not calling for legal sanctions to be in the standard or anything silly like that. They are merely saying that any DRM standard for online video must be executed in such a way that existing copyright infringement laws apply to it. In other words there should be a "copyright" field in the metadata, so there is no doubt about it.

Re:BBC not calling for legal sanctions

[OzPeter]

In other words there should be a "copyright" field in the metadata, so there is no doubt about it.

Ah .. so they finally want to implement the (almost) ten year old RFC 3514 IPv4 header!

Re:BBC not calling for legal sanctions

[OzPeter]

I am sure you know that rfc is a april fools joke. Maybe the moderators don't.

Yeah I know.. but it seems the joke's on me as the moderators obviously didn't read past the first page.

Trust Us

[overshoot]

Well, so much for open-source W3C-compliant browsers.

Re:Trust Us

[xaxa]

Well, so much for open-source W3C-compliant browsers.

The linked BBC email says:

Previous discussions on the W3C mailing list have looked at if the CDM itself should be defined or mandated to be open-source. We do not believe this would be helpful, primarily because it is difficult to see how an open-source CDM would have any hope of staying secure for any length of time at all. However, we would evaluate any open-source solution that did come along fairly against our criteria, and hope that adoption of a standard like the Encrypted Media Proposal will increase the amount of vendors offering CDM modules from the number of plug-in vendors that exist today as there would be a lower cost of entry. This may enable an open-source solution that we have not yet conceived to come to market.

That suggests a fundamental misunderstanding of encryption.

On another point, the BBC mentions the revenue from selling DVD and audio recordings -- the profit from this is £182M. That compares to £3606M of income from license payers, at £145.50 each, thus about 25M licenses are sold. If every licence-payer paid an extra £7 we wouldn't need to protect that content. (Have I calculated that correctly?)

(Other broadcasters with different funding models might still want this system.)

Re:Trust Us

[xaxa]

That suggests a fundamental misunderstanding of encryption.

Yes, it suggests my fundamental misunderstanding of the obvious.

The point is to prevent the owner of the computer from accessing the data, so it probably is incompatible with Free Software.

http://www.w3.org/community/pua/wiki/Digital_Rights_Management#DRM_is_against_open_source_software

Re:Trust Us

[serviscope_minor]

If every licence-payer paid an extra £7 we wouldn't need to protect that content.

selling DVD and audio recordings

They already have no need to protect it. Audio is now DRM free by default and the DRM on DVDs is so bad that it may as well not exist: there are hundreds of free and commercial programs for ripping DVDs and it's easy to buy unrestricted players off the shelf.

Furthermore all the video and audio recordings worth anything at all are already on TPB, yet they still sell them.

So, if every license payer paid an extra £0, we wouldn't need to protect the content.

Re:Trust Us

[DragonWriter]

That suggests a fundamental misunderstanding of encryption.

Actually, it suggest to me that the BBC understands exactly the reasons that the use of encryption to implement DRM is incompatible with open source (which they state outright that they believe it is), but that, as they have an interest in getting DRM specified in HTML and know that there are open source proponents who oppose this especially if it excludes open source solutions, hold out the false hope of "This may enable an open-source solution that we have not yet conceived to come to market", which some open source proponents who don't understand why DRM is fundamentally incompatible with it might grab on to and, with irrational hope for open source, actually believe that standardizing DRM will actually enable open source solutions to replace closed ones.

Re:Trust Us

[devent]

It's not encryption they are talking about, it's DRM. And they understand perfectly well DRM, that "open-source CDM (DRM) would have any hope of staying secure for any length of time at all". Yes, if you can't obfuscate the keys you can't hope to have any DRM.

Re:Trust Us

[aaron552]

It's more that if you can't prevent the decrypted stream from being recorded, your DRM is useless.

EME - That's a shit move

[Anonymous Coward]

Web Deli - "Serving fresh websites daily"
00:22 (0 minutes ago)

Attn: Philippe Le Hegaret
cc: Paul Cotton, Maciej Stachowiak, Sam Ruby

Dear Philippe et al,

Further to your discussion, [http://lists.w3.org/Archives/Public/public-html-admin/2013Feb/0122.html]

Adding DRM to the open web is a dick move.

When you are old you will look back and think... yeah we really fucked up when we did that.

But anyway - hindsight is usually clearer than foresight - personally I would think your respective talent could be put to better use.

What you do in the world matters, and doing what your doing is harmful - it's shaping a sub-optimal future.

Please reconsider the value of what you are doing and consider pursuing other projects.

Kind Regards,

Principal Web Developer
Julian Smith | Director

e: julian@webdeli.com.au
m: +61423797376

Web Deli - “Fresh websites served daily”
eCommerce | Online Marketing | Drupal | Email Solutions | PHP Development | iOS Development

Please send all mail to : 303/585 Little Collins Street, Melbourne, VIC, AUSTRALIA 3000

HTML is fine, its all the crap on top of it

[Anonymous Coward]

Flash, Java, Silverlight, take your pick.

As the world wide web has grown it has gotten more information and become LESS usable thanks to all of the crap loaded onto it.
Yes, I know I am falling into the old-school "Back in the day..." crowd here, but seriously- I have a 100mb internet connection now and compared to my old-school 14,400 modem back in the 90s average page load times are.... about the same.
The information I am able to find and use is also about the same.
The useless crap I have to sift through is now HUGE on the other hand, and it actually takes more time to find relevant information. I have to move past all the bad video posts, Twitter crap and asinine Facebook pages. And I haven't even mentioned the BS sites that do nothing but redirect seaarch terms to advert delivery pages.

Hell, I would rather go back to text-based internet browsing than be forced to "migrate to decent user interface technologies."
It's a web PAGE, pal. It should look and work like a PAGE.

Re:Closing of the Range

[SuricouRaven]

In sixty years, will people make greatly exagerated movies about life in the Wild Web?

Open Source Browsers

[acklenx]

Implement as much of the spec as you want.

Profit Machines

[AlabamaCajun]

HTML/Browser DRM is just another profit driver for big corporations. Just another tool to up their bottom line. It's nothing about the good of the people, protecting your machine from those that want to do wrong. If it were really about protecting any personal content then it would protect content I post on a private or public website. Look at how little control you have on Android and IOS already compared to 2000 when you had a freer internet on a pc. As for the major OSes playing together, won't happen. Each one wants dominance of the big marketing engine that use to be the internet.

BBC is calling for legal sanctions

[tuppe666]

"However, the BBC is unlikely to be able to use any such mechanism unless we feel that it is sufficiently secure that there would be the possibility of legal action in the event of bypassing it."

Not sure why you would defend the BBC, but that is pretty much the definition of a sanction. In fact it states quite clearly that the BBC is less interested in about how good the DRM is [they expect it to be broken], but whether anti-circumvention provisions is protected by law e.g. DMCA. It is just focused on stopping the people forced to pay for service in the UK having unrestricted access to the content they paid for.

Re:BBC is calling for legal sanctions

[FireFury03]

"However, the BBC is unlikely to be able to use any such mechanism unless we feel that it is sufficiently secure that there would be the possibility of legal action in the event of bypassing it."

Not sure why you would defend the BBC, but that is pretty much the definition of a sanction. In fact it states quite clearly that the BBC is less interested in about how good the DRM is [they expect it to be broken], but whether anti-circumvention provisions is protected by law e.g. DMCA. It is just focused on stopping the people forced to pay for service in the UK having unrestricted access to the content they paid for.

The BBC has a rather bonkers idea about DRM anyway. For example, HD Freesat receivers are required to implemtn DRM on their output (i.e. HDCP on the HD output, no analogue HD output, etc.), even though the DVB-S signal they are receiving is transmitted in the clear anyway. All it does is inconvenience legitimate consumers - anyone planning on copyright infringement is going to find it more trivial to record the raw DVB-S stream rather than an HDMI stream anyway.

Similarly, iPlayer's DRM is so weak as to be completely useless, and yet they still use it and therefore insist on using the terrible Flash player instead of making the video streams available in a standard format that would work on all platforms. (The flash player is so bad that I invariably just use get_iplayer and then play it with mplayer).

Re:BBC is calling for legal sanctions

[Ash Vince]

"However, the BBC is unlikely to be able to use any such mechanism unless we feel that it is sufficiently secure that there would be the possibility of legal action in the event of bypassing it."

Not sure why you would defend the BBC, but that is pretty much the definition of a sanction. In fact it states quite clearly that the BBC is less interested in about how good the DRM is [they expect it to be broken], but whether anti-circumvention provisions is protected by law e.g. DMCA. It is just focused on stopping the people forced to pay for service in the UK having unrestricted access to the content they paid for.

The BBC has a rather bonkers idea about DRM anyway. For example, HD Freesat receivers are required to implemtn DRM on their output (i.e. HDCP on the HD output, no analogue HD output, etc.), even though the DVB-S signal they are receiving is transmitted in the clear anyway. All it does is inconvenience legitimate consumers - anyone planning on copyright infringement is going to find it more trivial to record the raw DVB-S stream rather than an HDMI stream anyway.

Similarly, iPlayer's DRM is so weak as to be completely useless, and yet they still use it and therefore insist on using the terrible Flash player instead of making the video streams available in a standard format that would work on all platforms. (The flash player is so bad that I invariably just use get_iplayer and then play it with mplayer).

BTW, get_iplayer does not bypass DRM since the BBC do not use any.

http://linuxcentre.net/getiplayer

From the link above:

"get_iplayer, does the recording, indexing and searching of the iPlayer TV/Radio programmes and podcasts available. It can even stream the iPlayer TV programmes while recording them to mplayer, vlc or xine, etc. It does not circumvent any digital rights management security (see the BBC’s website on how to do that with the Windows-only DRM content they provide)."

Re:BBC is calling for legal sanctions

[FireFury03]

BTW, get_iplayer does not bypass DRM since the BBC do not use any.

http://linuxcentre.net/getiplayer

From the link above:

"get_iplayer, does the recording, indexing and searching of the iPlayer TV/Radio programmes and podcasts available. It can even stream the iPlayer TV programmes while recording them to mplayer, vlc or xine, etc. It does not circumvent any digital rights management security (see the BBC’s website on how to do that with the Windows-only DRM content they provide)."

Not entirely true. iPlayer uses SWF verification. It's a pretty worthless DRM mechanism, but its there.

Time for a new Internet.

[blcamp]

Because this will break it beyond repair.

The worst thing since ActiveX

[GeekDork]

That's pretty much all.

The best that this idiocy can possibly produce is further fragmentation of "The Web": right now, we have "kinda sane" standards in HTML 4.01 and XHTML 1, as well as CSS 2.1; everything beyond that are half-baked hacks in the form of several implementations of HTML 5, CSS 3 modules, their DOM APIs, and whatever browser vendors decided to implement. Adding DRM to the fray will not help things, since no matter how you look at it, you will end up with content only available on specialty browsers like Chrome, IE, or fringe mobile platforms, all the while still blissfully carrying the "HTML" tag.

At the end of the day, it will be cheaper for content peddlers to just cut out the bullshit and keep doing things in Flash, and I can't even say that I'm sad about it anymore.

Oh, and the W3C? They can go die in a car crash FWIW, it wouldn't be a huge loss beyond the humanitarian impact. Not like they did anything useful in the past 10 years.

Reality vs idealism: in reality, DRM doesn't work

[Anonymous Coward]

It's so tempting to just sit in the corner and say "DRM is evil, we don't want to taint the web with it" but unfortunately, as is often the case in the real world, we don't get to make decisions in isolation of their consequences.

It's not about the evilness of DRM, it's about the fact that it's useless. Has there been a DRM in history that has not been cracked? Why spend energy on a useless endeavour?

The people pushing for this may believe it's worthwhile and useful (or rather the content licensees do), but I think most people on Slashdot are clueful enough to know better.

So besides placating the studio executives, are there any valid (ideally technical) reasons why DRM should be pursued?

Binary

[jlebrech]

Isn't it time for a binary web standard anyways, the creation of a universal bytecode for the web would enable programmers to have the power to either build with or without drm, but would also deliver much more power.

Re:Binary

[h4rr4r]

Either you want java or something like it or you are going to tie the web to some architecture. I think you can see the flaws with both those plans.

Pay per view

[Anonymous Coward]

Is now on the web.

They should split off a commercial web from a free web via a TLD :)

Tax

[tuppe666]

On another point, the BBC mentions the revenue from selling DVD and audio recordings -- the profit from this is £182M. That compares to £3606M of income from license payers, at £145.50 each, thus about 25M licenses are sold. If every licence-payer paid an extra £7 we wouldn't need to protect that content. (Have I calculated that correctly?)

(Other broadcasters with different funding models might still want this system.)

More importantly those that *pay* for the content should simply get unrestricted access to it. The fact that the BBC make 5% profit on what is for all intended purposes a tax, simply shows how poor the content is. As for being taxed higher for the privileged something, how about they get paid a little less.

Re:Tax

[TractorBarry]

And those that don't want the content should not have to pay the ridiclous licence fee.

Re:Tax

[Ash Vince]

On another point, the BBC mentions the revenue from selling DVD and audio recordings -- the profit from this is £182M. That compares to £3606M of income from license payers, at £145.50 each, thus about 25M licenses are sold. If every licence-payer paid an extra £7 we wouldn't need to protect that content. (Have I calculated that correctly?)

(Other broadcasters with different funding models might still want this system.)

More importantly those that *pay* for the content should simply get unrestricted access to it. The fact that the BBC make 5% profit on what is for all intended purposes a tax, simply shows how poor the content is. As for being taxed higher for the privileged something, how about they get paid a little less.

Poor content? Compared to 90% of the bland shit that is produced by the other big commercial producers (Sky, HBO, ITV, etc) the BBC stuff is far better. It is also very different and be more likely to appeal to niche markets and be more experimental.

On top of that the news the BBC produces is what also makes it stand out. It might fuck up occasionally, but so does everyone. The important thing to my mind is that it is a news network not solely driven by the point of view of a single (exceedingly rich) proprietor.

Do I see a hole in the DRM?

[MathFox]

Nothing in the "Encrypted Media Extension" specs prevents or forbids proxying of both the key and the encrypted media stream to an external "decryption and caching" service. And all of the usual "how do we prevent the plaintext from leaking from the user's machine" questions are still in full force. It is unlikely that the W3C will get "effective protection".

DRM html??

[Dcnjoe60]

Ummm, if the DRM is in the html code, then what is to stop somebody from having html code that circumvents the DRM? Here is a better idea. If you have content that you want to protect, then protect it on your end. Yes, it is less convenient for your users, but if they value your content they will still jump through your hoops. If they don't they will go elsewhere. Most likely the content owners realize that their content isn't all that valuable and if they try and restrict it on their end, people will indeed go elsewhere. However, that is how free markets are supposed to work.

Use online newspapers as an example. Many have paywalls and do quite well, with that model, however, those that do not want to pay, get their content elsewhere. It doesn't require DRM built into HTML to protect content.

Re:Reality vs idealism: in reality, DRM doesn't wo

[gl4ss]

So besides placating the studio executives, are there any valid (ideally technical) reasons why DRM should be pursued?

getting licensing on browsers so browser (trio, whatever, doesn't matter)monopoly can be created.
then they can create browsers without adblockers, cache flushing, cookie flushing etc..

it's both a technical and ideological explanation. not a pretty one.

Re:Closing of the Range

[viking099]

That would be awesome! It would be a whole new angle on the historic GIANT SPIDERS that roamed the Wild, Wild West!

What happened to the W3C?

[fritsd]

Here, read this: http://lists.w3.org/Archives/Public/public-html-admin/2013Feb/0137.html, this person puts it very clearly: WTF is the W3C doing trying to *hinder* an open accessible web? DRM is against what their purpose in life as an organisation is.

Did "the Director" die, or something??

Disgracefully Poor Content

[tuppe666]

Poor content? Compared to 90% of the bland shit that is produced by the other big commercial producers (Sky, HBO, ITV, etc) the BBC stuff is far better

I would disagree. In fact if I was legally allowed the option. I would cancel my TV license and subscribe to netflix which is less than half the price :)

Re:Disgracefully Poor Content

[serviscope_minor]

I would disagree. In fact if I was legally allowed the option. I would cancel my TV license and subscribe to netflix which is less than half the price :)

So do it then, that's perfectly legal. I own no TV (i.e. broadcast receiver), but watch plenty of non live stuff online and DVDs. It's 100% legal too.

Re:Disgracefully Poor Content

[Ash Vince]

Poor content? Compared to 90% of the bland shit that is produced by the other big commercial producers (Sky, HBO, ITV, etc) the BBC stuff is far better

I would disagree. In fact if I was legally allowed the option. I would cancel my TV license and subscribe to netflix which is less than half the price :)

You are legally allowed the option moron. http://www.tvlicensing.co.uk/check/viewtopiccontent.aspx?id=TOP12&iqdocumentid=TOP12&WT.mc_id=r001

They recognise that a great many people own a huge TV but don't actually use it for watching live TV so do not need a licence. If you are only interested in watching netflix just follow the link I posted above and stop wasting our time with your ignorance.

Chicken Little

[Hypotensive]

All that the W3C rep said is that it is within the scope of the HTML WG to work on this API. The API describes how to interact with an optional module. Nothing in the standard says that a user agent must support this module. Blaming the HTML WG for DRMed content is a bit like blaming your television manufacturer for Fox News.

End of "View Source"?

[Bazman]

Is that the idea? That the HTML behind web pages isn't viewable? That web pages can't be printed? Or can't be viewed after three days?

Just go use a PDF ffs.

So, it will be EXACTLY what we have now...

[tekrat]

The ads will load into your browser, but not the content you were trying to access. The Ads will play a video, but then the video you were trying to see will generate an error. While you're at work, an annoying sound will come from the ads, but you still won't be able to read the article you were hoping to read.

The web has already become useless. Every site is so loaded with crap ads, you can't even FIND the content you were googling for. So go ahead, add the DRM. It won't change anything. It won't work, it'll cost more money to implement, and you'll get less ad revenue as even more people give up as I have.

Long live the web, death to the web.

HTMLMediaElement is ALREADY part of HTML

[AwaxSlashdot]

The proposal is to extend HTMLMediaElement (which is an ALREADY existing part of HTML) so it supports DRM in a standard way.
HTMLMediaElement is a specific DOM element that correspond to media elements (audio, video) and extends the standard element with media specific features: play, pause, length, volume, etc ...

The proposal is to recognize that DRMs are an widespread feature used in conjunction with media elements. As such, it is worth standardizing.

If the DOM accepts having play/pause features on a media element, it could also support DRM methods on a specialization of this element.

As you said, the implementation and enforcement of DRM is EXTERNAL to the DOM/HTML. Have you read the proposal ? I guess you didn't because the ONLY thing this proposal adds is a bunch of events and methods to allow javascript to provide the key to decrypt an encrypted flow.

Re:HTMLMediaElement is ALREADY part of HTML

[bipbop]

That ship sailed for the web a long, LONG time ago.

Re:HTMLMediaElement is ALREADY part of HTML

[strikethree]

Ah. So we should just go along with building the guillotine because the blade is not included. Right.

Re:HTMLMediaElement is ALREADY part of HTML

[Pieroxy]

Now I know what's in the proposal, and it spawned two things in my mind:

1. It is far less dangerous than what the ridiculous Slashdot headling led me to believe
2. It seems even more ridiculous than I though it could. Actually, pathetic is a better word. Pointless, vain, plenty of words fit actually.

Dear lawyers and media lobbyists,

[Morpf]

please leave our internet alone.

The internet leaving non-profit status behind.

[concealment]

When the internet was non-profit, it was a community where people contributed things to be spread around. The idea was that this facilitated the growth of knowledge.

However, once you introduce commercial information to the picture, it needs to be defended because people need to get paid or they'll stop producing it and you'll be left with less powerful alternatives. One reason that we have industries is so that we can concentrate talent and reward the best, thus producing the best products.

At this point, I think it makes sense to start talking about a neo-Internet ("new internet") where all content is GPL licensed and designed to be shared. This would not be a Utopia. A lot of content (porn, entertainment, shopping) would probably not belong there.

But for those who just want to swap code and information, it would be great.

So, video codecs are out of scope, but DRM isn't?

[GNUALMAFUERTE]

We badly needed the W3C to define a codec when they defined the HTML5 video standard. They didn't. They said it was out of scope. To this day, HTML5 video isn't widespread yet because of that. Apple and microsoft are pushing their own agenda in having a proprietary, controlled, patented standard in which they hold interests used, while disregarding technically viable, free, open solutions such as Theora or WebM.

But the motherfucking codec was "out of scope".

And DRM is in scope? What the fuck people! You consider you have no say in the very fucking core of the video playing system, but you do get to taint the web with unnecessary shit such as DRM?

Everyone at the w3c can go fuck themselves.

Linux == rounding error

[tepples]

designers that don't care about Linux

Why should they care when there are other more profitable things to care about? I was under the impression that X11/Linux still had a usage share indistinguishable from a rounding error.

Re:Linux == rounding error

[TheRaven64]

Because they understand economics. A good strategy for any industry is to commoditise complementary markets. If you make films, you want the equipment required to watch films to be cheap so that people wanting to spend money on films give the majority of it to you, and the best way of making this happen is ensuring that there are a lot of competing manufacturers of film-playing equipment able to play the recordings you produce. DRM can only work by restricting access to keys that are shipped to clients, so you artificially limit the number of people creating the playback hardware or software. The artificial scarcity reduces competition and pushes the cost up. Worse, it makes the holder of the authoritative keys more powerful. Remember when the iTunes store had DRM for music? Anyone wanting to sell music had to agree to Apple's conditions. The reason the music labels ditched DRM was that it was the only way of breaking Apple's monopoly. The movie studios, with their insistence on Silverlight DRM, are trying to put Microsoft in the same position.

More importantly, it prevents the creation of new and innovative players by anyone other than the existing manufacturers. In under 20 years saw the normal way of playing back music shift from shiny disks to tracks on a large storage device. We haven't seen the same shift for movies, because they had tighter DRM and so there was nothing like iTunes for DVDs (open source tools exist, but any time they are shipped in something that looks like a commercial product the studios sue the manufacturer out of existence).

Re:Linux == rounding error

[tepples]

We haven't seen the same shift for movies, because they had tighter DRM

That and because the vast majority of movies and TV shows aren't watched more than once,[1] making a rental model more viable than a model that anticipates only purchases. Read the BBC's comment linked from the summary.

[1] Except for G-rated animated films, which play into a small child's greater tolerance for repetition: "I wanna watch Sin-duh-weh-wuh again."

Re:Linux == rounding error

[tepples]

the point is not that they should actively care about LInux, but rather that they should not actively obstruct it

On Linux, DRM means something else entirely. What facility does the GNU/Linux platform offer to ensure that all high-definition video outputs are tee-resistant?[1] Answer this and I'll address your comment about the difference between "care about" and "not obstruct".

[1] man tee

Re:Linux == rounding error

[aaron552]

Even on "tee-resistant" systems there is always the analogue hole.

Re:Linux == rounding error

[tepples]

When you copy a video game through the analog hole, you get a playthrough video, which is no substitute for the game itself.

Substitute good

[tepples]

but when a web service/site tries to funnel me into having to use an app

...you do what, exactly?

The impression I got from the incomplete sentence was "I find a close substitute".

But then this runs into problems when a web site provides a native application precisely to work around limitations of Safari for iOS, such as the restrictions on the media object upload element (<input type="file">) in iOS. Only pictures and videos are supported, not other media types, the element was completely unavailable prior to iOS 6, and live streaming from the camera is still completely unavailable in Safari for iOS. (Source)

Re:Reality vs idealism: in reality, DRM doesn't wo

[Ambiguous Puzuma]

Has there been a DRM in history that has not been cracked?

To my knowledge, the system used to restrict digital cable has not been cracked (apart from the "analog hole" workaround). That's the only example that comes to mind though.

To defeat the analog hole

[tepples]

you need to output unencrypted content to the end user

In the case of music or video, a recording of this output is a substitute for the legitimate copy. In the case of a video game, it is not. So to defeat the analog hole, produce interactive works.

Re:To defeat the analog hole

[Cenan]

Correct, in the case of an MMO, where the game engine never leaves the software company's server, there is a significant delay in working "duplicates". They do appear in most cases however. Any other game or interactive content suffer from the same problems as video or music: unencrypted content is placed inside a domain the user controls.

Large monitor incapable of receiving broadcasts

[tepples]

So how does one buy a large enough monitor that is incapable of receiving broadcasts? Perhaps the UK market is different, but all the living-room-size monitors I see in the USA are capable of receiving broadcasts.

Re:Large monitor incapable of receiving broadcasts

[serviscope_minor]

So how does one buy a large enough monitor that is incapable of receiving broadcasts? Perhaps the UK market is different, but all the living-room-size monitors I see in the USA are capable of receiving broadcasts.

Actually, I glossed over. You merely have to not use it for receiving broadcasts. It's prefectly legal to own an unused receiver without a license. Capita (the licesing people) don't like to tell you this since they rely on the license for their money---the BBC gets a fixed free and Capita keep the difference.

Also, they've never prosecuted a single person who hasn't let them in and owned up.

Re:Focus on the specifics. "DRM Bad" is dumb

[peppepz]

Lets focus on the specifics of EME. "DRM Bad" is a gross oversimplification.

Interesting, let's see.

I think we can all agree that HTTPS is a good idea - it lets us securely communicate with our bank etc.

Indeed, that's because HTTPS has nothing to do with DRM, besides the fact that both use encryption. HTTPS serves the user, and the user has full control over it.

What if our bank wants to send us a video message, or we want to watch one of our home videos we've stored on a cloud server? Well, we could use HTTPS for that. But HTTPS requires the server to encrypt the content as we're streaming it... that's probably OK for those scenarios, since there won't be more than one person downloading the same video at once.

Exactly. So far, no uses for DRM. Let's hear further.

Now suppose a video store offers to sell us a video. Of course we'd use HTTPS to send our credit card details to prevent them getting intercepted by hackers. The video store might let us download or stream the video over HTTPS. But HTTPS requires the server to encrypt the content as we're streaming it, and if lots of people are streaming the same video the server will be very busy. What's more, since the server has to send differently-encrypted data to different people, they can't use a CDN to spread the load (unless they load their private key into all the CDN boxes, which would be insecure). The solution is EME with the "Clear Key" encryption: the store encrypts the video file once, and tells us to stream the encrypted video file over plain HTTP from their CDN. They then send us the key over HTTPS. The browser uses that key to decrypt the file. Note that there's no "DRM" anti-consumer stuff here - the consumer's web browser has both the key and the encrypted data, and could save those if they wanted to. It's just protecting the data as it flows over the network, like HTTPS does.

What you described is no DRM. The server is giving the user full access to the media, by giving the key to him. They could as well store the media inside a password-protected zip file, serve it over plain HTTP, then send the password for that file to the user. It would have achieved the same level of security. The point is that no media company will use such a model for distribution, because a single user could give away his password to all the other users, making the system ineffective. In fact, no user's right is restricted by this model, there's no "black box" software or hardware involved, there are no encryption keys ureachable to the user, there's no personal information of the user stored inside the media. This is not DRM and this is not what people are afraid of.

Now, EME does also have hooks for a full DRM system. It doesn't specify a full DRM system - it's just hooks so your browser could include a DRM system if it wanted to. Rather than getting the clear key over HTTPS, the browser can get some encrypted data that's passed to the DRM system. The DRM system then does it's thing and decrypts the video, presumably applying copy protection as it does.

So after you've talked so much about completely irrelevant topics, you dismiss the actual problem with three lines and no argumentation. You're actually worsening my concerns, because not only you're telling us that EME will force all content consumers on the web to implement DRM and pay for its implementation and its computational overhead, but also you're giving us reason to believe that the specification will be incomplete, and every content publisher will be free to implement or license a different digital restriction management system based on those "hooks", forcing the users to choose what content they want to access, or to implement or license all of the competing systems, as is already happening with DRM systems for digital television broadcasting.

The sort of companies who are going

Re:Fuck it

[peppepz]

I, for one, will start with the boycott of any browser coming from one of the companies involved in this poisoning of the Web - on my computers and on those that people trust me to maintain.

Tamper-resistant smart cards

[tepples]

Then why don't satellite TV access cards get hacked more often? Run certain parts of the game engine inside a smart card like that.

Re:Tamper-resistant smart cards

[AmonTheMetalhead]

Don't these things get hacked on a daily basis?

Gravity

[phorm]

Gravity is really annoying for the American Airlines. Those are the breaks.

I'm fairly sure that without gravity, American Airlines wouldn't have much business. People could just flap their arms and fly to Mexico/Australia for the winter :-)

Re:Gravity

[lister king of smeg]

Gravity is really annoying for the American Airlines. Those are the breaks.

I'm fairly sure that without gravity, American Airlines wouldn't have much business. People could just flap their arms and fly to Mexico/Australia for the winter :-)

without gravity we would already of experienced the heat death of the universe. loss of an airlines business would be the least of your problems

Better one standard than a dozen shitty ones.

[inhuman_4]

I know that I'm not going to be with the majority on this one, but I support this.

The choice here isn't between a web with DRM and a web without DRM. The choice is between a web with one good standard, or a dozen crappy proprietary solutions.

Lets be realistic here. If DRM was not supported in the W3C standards then we would just end up with a mess of proprietary standards in its place. I hate DRM as much as the next slashdotter, but I hate having to load up shitty proprietary standards to handle DRM even more. During that last Olympics I had to boot into windows to watch the online stream because the CBC used silverlight, and the linux version was not compatible. Without some kind of standard this kind of shit we have going on with flash, silverlight, etc. is never going to stop.

Re:Better one standard than a dozen shitty ones.

[peppepz]

This standard merely describes a plugin system that incompatible, binary-only, third-party plugins (CDM) will hook into. In fact, besides other champions such as Google and Apple, this standard is being pushed by Adobe, the developers of Flash.

So not much will change from the mosaic of "shitty proprietary standards" that we have today. It's just that the developers of those plugins don't want to handle media presentation anymore, and with this standard they can only care about data encryption and user surveillance. I'm afraid we can't even dream of seeing CDM plugins on Linux.

Read for example the concerns of this person from Mozilla: https://www.w3.org/Bugs/Public/show_bug.cgi?id=20944

Re:Better one standard than a dozen shitty ones.

[Unknown Lamer]

Here's the thing with having a dozen crappy proprietary solutions: divide and conquer. Let them try, and watch them fail I say.

Re:Fine with this.

[peppepz]

and our browsers might be a bit more stable because we'll have more competent people getting the edges of the DRM right

You'll still need binary plugins to interface with your browser, because this draft specification deliberately only covers the "glue", not the DRM mechanism itself. DRM can't be implemented in open source. You'll have to download and install different, incompatible binary plugins from (say) Google or Adobe in order to view the media offered by Google sites or Adobe sites. Of course, you'll have to be running on one of the platforms supported by the plugins, otherwise no content for you.

Hi! ho! Yet Another Parameter Passing Mechanism

[TheRealHocusLocus]

The media's directly linked, it has a URL---
Hi! ho! the derry-o, we simply GET the stream.

The link has gobble-de-gook, it changes every time---
Hi! Ho! the derry-o, we follow redirect.

It's encrypted with a key, the key is passed to me---
Hi! ho! the derry-o, our extension reads it for free.

The key comes from a script, the script talks only to Fred---
Hi! Ho! the derry-o, our sandbox looks like Fred.

A dongle decodes the stream, which plugs into USB---
Hi! Ho! the derry-o, its Certs have just been leaked.

It's all secure at last! A special TV decodes it all---
Hi! Ho! the derry-o, they didn't sell any at all.

It's encrypted again but now, NO ONE gets the key---
Hi! Ho! the derry-o, we watch Gaussian noise for free.

I'm used to it. Digital TV reception in my area closely resembles watching a raw stream of encrypted video where only God has the key. A pretty mosaic of brightly colored boxes that rearrange themselves into endless, hypnotic patterns. Its audio is mercifully muted.

Frankly, I'm amazed at the progress we've made.

Cool

[nixkuroi]

I can't wait until they implement code obfuscation so nobody can steal my JavaScript or make fun of me when I use tables! /sarcasm

Stallman wrong

[DragonWriter]

PS: Of course Richard Stallman was again all correct about cloud services: Cloud computing is a trap, warns GNU founder Richard Stallman

Actually, Stallman was wrong on that, starting with confusing out "renting out services run on someone else's computers" (which is the actual source of the "trap", insofar as it exists, that he refers to, and is a practice nearly as old as business use of computers) with "cloud computing" (which is a set of technologies relating to dynamic allocation of resources -- virtual servers, etc. -- which has many applications, including, but not limited to, more efficiently implementing the kind of remote third-party services which have been around forever in which Stallman sees a "trap".)

Re:So, video codecs are out of scope, but DRM isn'

[GNUALMAFUERTE]

People have told me that when I get really pissed I'm equal parts insightful (when I'm right), scary, and funny.

Re:So, video codecs are out of scope, but DRM isn'

[GuB-42]

As evil as DRM is, the proposal is technically more "in scope" than video codecs.
The reason why the video codec is considered out of scope is because there is no "best" choice and there is room for improvement (see : h.265, VP9). As for the "proprietary, controlled, patented standard", I believe you mean h.264 aka MPEG4-AVC. Well, sure, it is not free but technically, it is the best for now, plus it has very good hardware support. And we are not certain that WebM is really patent-free considering how close it is to h.264 in some areas. (more info : http://x264dev.multimedia.cx/archives/377).
On the other hand, the proposed mechanism for DRM is much more abstract. It is just an entry point for the decoder to request a key. Nowhere a specific algorithm is mentioned. And the way to actually protect the content is totally out of scope.

Reality

[Sloppy]

How much work are you willing to do to watch that movie for free where you can pay a $10 a month subscription or rent it for $2.00? Is it worth trying different patches made by people of questionable ethics, perhaps having to rebuild you OS every once in a while until you find the good patch.

Arrghh.. Really? People can still totally misunderstand the situation this badly, in 2013?

The people who endure the things that you're talking about, also pay. The fact that they paid for the DRMed media, is why they have DRMed media. Nobody does anything like what you're talking about, to avoid paying.

People who don't pay, don't go through any of that. How much work am I willing to do to watch that movie for free? NONE. The free content is what works on a computer without any patches, rebuilding, soldering, etc; it works under normal conditions with normal hardware and software. That's the smooth, reliable case, and since anyone and everyone can work on it, there are many players competing against each other to be The Best.

The non-free DRMed content, is the stuff where the computer is always abnormal in some regard. Either the computer is actively hostile to its user (i.e. the user just accepts the absurdity of the DRM-compatible players' artificial limitations and their general lack of competitive features), or it's schizophrenic and (possibly) unreliable, due to needing to [appear to] serve two masters (the case you seem to be harping on).

There's not even a grey area worth speaking of. It's not a matter of "some non-payers have to deal with DRM and some customers don't." These are truly all-or-nothing scenarios, where the exceptions are so rare that it's not worth speaking of. Everyone who makes use of pirated media, is free from having to deal with DRM bullshit while they use that media. And similarly, everyone who does struggle with DRM, is always working with a non-pirated copy, which was paid for, unless you're talking about some fringe case of shoplifting or something like that. Don't you understand that?

So it's not a matter of keeping the honest honest. It's a matter of punishing and discouraging the honest for the "crime"(?) of being honest, constantly tempting them with the promise of how much nicer and easier things will be, if they defect.

Re:Closing of the Range

[cheekyjohnson]

It sucks, but it is what it is.

I don't think that's a very good attitude. Their goals on not realistic to begin with.

hook [DRM] somehow into the open web platform

[devent]

http://lists.w3.org/Archives/Public/public-html-admin/2013Feb/0176.html

The question that lies open before us is: given that DRM exists, should it be implemented through proprietary plugins or should it be possible to hook it somehow into the open web platform?

How it can be possible to have an open platform and to "hook" DRM in it? DRM and an open platform are a contradiction. Good, you can give me the keys and the encryption scheme of your DRM and ask me to "follow the rules" to not copy the data. Anything other then to ask me polity to not copy your movie with the keys and the encryption scheme you just gave me, will be a closed platform.

It's a difficult question in part because even if you have the clear
goal that DRM should be eradicated — which you'll find is a view
actually shared by many people who support EME (in this form or another)
— there is no way to prove which path will most likely succeed in
attaining that goal.

I do know what will not archive that goal: to accolade DRM to a W3C standard. How can you say that people are opposing DRM and are actively working on a DRM W3C standard?

It certainly seems to be the case that platforms that probably
should have died a while back (e.g. Flash, Silverlight) survive to this
day because they support DRM.

Yes and now you are working to bring this to the open web. Which is not possible in an open web anyway, because you can't give me the keys and the encryption scheme and expect any security. So you can just drop the DRM in the first place and give me the content unencrypted.

We can all make guesses, we can have intuitions, but if we're being
honest there's no telling which strategy is most likely to succeed in
either eliminating DRM or turning it into something that's user friendly.

So that is the true agenda. To hook DRM in the open web as much as the user is not aware of it? That means turn the control over to the content producers. So basically, he is admitting defeat to Flash and Silverlight and wants to incorporate proprietary components in the open web. But by that in the future if you want to see "premium content" (from W3C) you have to accept those proprietary components in your open browser.

So what was the goal again for the W3C? To replace Flash and Silverlight with W3C proprietary components? I guess that's where the money is made.

Re:So, video codecs are out of scope, but DRM isn'

[ducomputergeek]

It's not Apple and Microsoft. It's them plus a couple dozen more companies that are a part of the H.264 pool. Basically anyone who makes electronics is in the MPEG-LA pool. And H.264 was pretty good at the time not to mention being widely adapted by all kinds of devices from phones to computers to set top boxes to game consoles. It became the Defacto standard.

WebM and everything else had the problem of not being significantly better than H.264 with a lot more problems. Video people remember the nightmare of competing players, containers, and codecs in late 90's and early 2000's. H.264 put an end to that. The last thing they wanted to do was have to go back to having to recode video in more than one format.

If WebM/Theora offered a significantly more compelling technical reason, say offered same quality as H.264 with smaller file sizes or faster encode times, then it would have been widely adopted by the industry. But it didn't. The only motivation to use it was purely ideological. Also video people were used to things being expensive. Compared to other equipment and software, an H.264 license isn't that expensive. If you are doing professional video you are used to the licensing models with music, actors, etc.. And most people trying to make a living around video could care less about the ideology. If it's not better, they aren't going to use it. And they will pay to use a better product.

Re:So, video codecs are out of scope, but DRM isn'

[GNUALMAFUERTE]

I could be considered "video people" (my associate has worked on TV his entire life, and our company produces several systems that are video-related, including a DVR/NVR). And yes, we do offer h.264 support, and yes, it's technically superior to everything else there is right now, including Ogg Theora and WebM, specially in the speed of the encoder. Also, there are no DSPs that support Webm or Theora, while there is plenty of hardware acceleration for h.264.

Here comes the so-fucking-what part. That is the past. That's what we had. HTML5 was supposed to be about getting things right and future-proof this time. We've all suffered format wars, and we all know what happens with vendor control over standards. We all wanted to get away from anything proprietary, HTML5 exists to get rid of flash, plugins, etc. Then they boycotted themselves. No capture interfaces for video/audio, they where discarded at the last second, so we still depend on flash for that. No real video element, since the lack of a single codec makes it useless.

Sincerely, I couldn't care less about what "video people" think about the web. Everyone in the web community outside people in the MPEG-LA group wanted WebM or Theora.

So, yeah, a switch would've been traumatic at first, but it would be worthwhile in the long run, and all the people that matters where willing to go through with it.

Re:So, video codecs are out of scope, but DRM isn'

[devent]

As far as I understood the EME the W3C will not define any particular implementation, but will provide an interface to Content Decryption Modules. Vendors can then set a key and the CDM will decrypt the content.

So basically it's the same as with codecs. The W3C failed to define a set of open codecs and they are not defining any particular DRM.
I guess that means that the system or the browser will provide such CDM with the help of TPM and the W3C just provides a standard set of API to set keys and decrypt content.

It's just like Flash or Silverlight, with the minor difference that the DRM will run in your system.
See https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-media/encrypted-media.html

TPM and Secure Boot

[tepples]

You can always just play back the video in a VM (vmware, wine, whatever)

The Trusted Platform Module and UEFI Secure Boot specifications were created specifically to allow a program to know what kind of VM it's running in.

Principles

[Thomas Shaddack]

Yes. Because there is something called principles. Because freedom is not free. Because there are friends that will ask for help with the same. And because then you can publish/validate the approaches that worked so others would not have to go through the blind alleys.
Hardware is cheap these days, and if you get a good deal on a stereomicroscope the soldering of even tiny SMD parts is about as easy as it can get.

This not the ultimate golden key

[AwaxSlashdot]

Nothing. But you can't actually do anything with this key.

The key is generated by a license server and used by a decryption module. The decryption module is in charge of validating the key and decrypting the media.
Even if you grab the key (trivial as you said), you still need the decryption module to accept it.

So, it is up to the decryption module (a plugin to the browser) to have a correct security scheme to avoid reusing this key outside its intended use. The best use case would be to have a key containing a date range for its validity (for example, 48h validity for VoD, a week or a month for a weekly/monthly SVoD) and maybe content id (for a single movie VoD), the whole key signed with a private key from the license server and the public in the decryption module.

So for a 48h VoD, it is not an issue if you grab the key because the DRM implementer is aware of that and should be able to work its DRM scheme to support it.

Please

[AwaxSlashdot]

Death penalty is wrong in any occasion.
Renting a movie for 48h is perfectly ok.

So having a standard mechanism for browser to be notified that the content is protected and requires a key it can request to an license server and then pass back the obtained key to a decryption module that would enforce the content protection is 100% legitimate.

The REAL problem with DRM is not that they exists: they are perfectly legitimate in a society where we accept that people could own things privately. The real prob is their abuse, enforcement of stupid things and sloppy implementation. I don't care if my DVD or my BluRay is encrypted. However, I do care if it prevents me from skipping the stupid FBI warning or the upcoming-movies-i-don-t-care trailers. DRMs are a pain in the ass and 100% inefficient for things you own permanently.

However, DRM are an efficient way to support renting content for 2 simples reasons:
* renting being a one shot act, I can easily see another company to rent my next movie if the experience is subpar. So there is a huge incentive for the company to provide a great experience.
* rented media do expire. So a company can update its DRM scheme to improve user experience without breaking compatibility with content already sold.

Recording with a notebook prohibited in a shop

[Aleksej]

with a paper notebook and a pen: http://veronika-funtom.livejournal.com/519477.html (in Russian)