Slashdot Mirror
Google Quietly Makes 'Optional' Web DRM Mandatory In Chrome (boingboing.net)
JustAnotherOldGuy quotes a report from Boing Boing: The World Wide Web Consortium's Encrypted Media Extensions (EME) is a DRM system for web video, being pushed by Netflix, movie studios, and a few broadcasters. It's been hugely controversial within the W3C and outside of it, but one argument that DRM defenders have made throughout the debate is that the DRM is optional, and if you don't like it, you don't have to use it. That's not true any more. Some time in the past few days, Google quietly updated Chrome (and derivative browsers like Chromium) so that Widevine (Google's version of EME) can no longer be disabled; it comes switched on and installed in every Chrome instance. Because of laws like section 1201 of the U.S. Digital Millennium Copyright Act (and Canada's Bill C11, and EU implementations of Article 6 of the EUCD), browsers that have DRM in them are risky for security researchers to audit. These laws provide both criminal and civil penalties for those who tamper with DRM, even for legal, legitimate purposes, and courts and companies have interpreted this to mean that companies can punish security researchers who reveal defects in their products. Further reading: Boing Boing and Hacker News.
Don't care about netflix so bye bye chrome.
They've moved the options regarding Flash and PDF Reader plugins. Widevine is not listed nor given the option to be disabled within the UI.
Also these are Plugins not Extensions, two entirely different things.
Google Chrome is not open source. Only Chromium is. And Chromium already has web DRM disabled by default. So you will only have to build Chromium, without any changes to the source code at all.
Or is anyone else getting tired of basic internet tools being turned in to monsters? By that I am talking about FireFox deciding to not trust a certificate, you can't select "Yes, I know, give it to me anyway". EG: StartCom's certs - you can't click past, you have to use another browser.
Another example: Java 8 - I maintain servers. Many thousands of them, all over the globe. No, I can't put valid certificates on them. That would violate compliance in the first place, in the second place, we are talking $many^3 servers. But in Java 8, you have to add the IP to an exception list. Yeah, that's a lot to maintain. So we don't use Java 8.
Please guys that write this stuff - you cannot make unilateral decisions on security and not impact workloads. Yes, the average Internet user is an idiot and needs to be protected, but those non-idiots don't have the hours of time needed to get around your unilateral coding decisions.
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
I'm speaking to at scale work, not simply a few thousand servers. Add more orders of magnitude.
What you discuss is absolutely possible. If you have time, or manpower to dedicate to watching every single part of every single tool used. Management is simply not going to pay that salary. And since not every single tool is under constant, close scrutiny, the opportunity for sudden work stoppages is much greater. I simply cited the tools everyone knows.
What you suggest about selecting software - not so much when you work at scale. Think many thousands of people, always with that percentage that simply don't get the news. (There's always someone).
IT was suggested that we start using containers or VMs for maintenance. This is what we've come to. You can no longer depend on tools you own and supervise, you have to lock them up and proactively defend them - from their own makers.
I find that astonishing.
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
Nope. Stop right there citizen.
Changing ANYTHING about the DRM stuff is a no-no under the DMCA. You have no right to block it. You have no right to turn it off, and coming soon, you will have no right to a computer or software without it.
In all seriousness though, I do wonder if changing the permissions on or deleting a DLL that provides DRM would be considered "tampering or circumventing a technological protection measure" under the DMCA and it's variants. Of course the browser is entitled not to play the content if that's the case, but my money is on the "You bet your ass it is." side considering that "helps" to increase corporate profits.