Web DRM moves to next phase, Defective by Design to continue opposition(defectivebydesign.org) |
Web DRM moves to next phase, Defective by Design to continue opposition(defectivebydesign.org) |
The tone is so aggressive and slanderous that even though I should nominally be on the side of the author, I find myself thinking "surely there is another side to this story" and come away with the feeling that I should step back and consider that maybe the other side is in fact in the right.
It's like reading angry anti-nuclear activists and (either side of) the climate change debate. Whoever wrote that angry irrational rant is surely not somebody I want to be on the same side of any issue with. Maybe I'll check out the other opinion to see if they have anybody sensible to articulate it.
2) The portmanteaus are in-jokes for the people who already agree with the author. This makes me think that the author is so focused on their own social bubble that they haven't seriously wrestled with a well-written argument by the other side. If that is the case, then I can't trust the author to not have massively overlooked some important counter argument, so I have to go look for it myself.
3) The same as above, but also: life involves judgement calls and intuitive evaluations of situations. Sometimes, you see interpret another person's words in a way that is wildly detached from what they said. This makes you trust others interpretations less unless you can either see the primary sources yourself, or see them wrestling seriously with the other side's argument.
It would be nice if we judged all arguments just on their facts, but time is limited and so we have to make judgements like these.
Firstly, I think you make a very good point. I experience a similar feeling when I read things that appear one-sided, and I try in my writing to communicate the fact that both sides of the issue have been considered, even if I think one is completely absurd. I'll take your criticism into account with future writing about EME.
FWIW, here's the other side of the argument as I understand it:
"DRM is already happening on the Web, so we might as well do it at the W3C, with the vague hope that we will win some kind of concession from the DRM companies. Also, maybe if we don't, they will take their content off the Web and into some other system (subtext -- we care more about Netflix being on the Web as defined by W3C than we do about the Web as defined by W3C being free and open.
a) The Membership of the W3C have decided they want to work on DRM.
b) Like most industry consortiums, the W3C is ultimately beholden to its (industrial) Membership. (And it's not clear they can refuse an organisation from joining as a Member without opening themselves up to allegations of being a cartel and the legal complications that would involve.)
A lot of this comes down to the relationship between the W3C and its Member organisations, and whether the W3C can refuse to work on something its Members want to.
There's also some of what you alluded to, which I will call c) A number of Member organisations have made it clear that they will work on this in some public forum regardless of what that forum is.
Now, from a purely pragmatic point-of-view, what is gained by the W3C refusing to work on it? Apple, Google, and Microsoft will still ship DRM modules; the web will still start relying on DRM modules existing within browsers. The outcome is entirely unchanged, as ultimately because of c we've ended up with an interoperable API from JS one can use to deal with DRM modules.
Refusing the venue is purely making a political point, it doesn't change the outcome. Now maybe that political point is a goal in and of itself, but given most of the arguments people make against DRM I'd suggest the goal here isn't a political point but rather reduction of reliance of DRM on the web.
By refusing to work on it, you upset the Membership (because you're going against them), jeopardising your own future (because a industrial consortium is nothing without Members), and not changing the outcome.
But your perspective is important.
I encourage you to write to campaigns@fsf.org; I know personally that Zak and others will value your input.
I personally don't agree with this, and get the feeling that there's a very heavy corporate hand in place threatening to move consumers (e.g. Netflix saying people just want to watch video damnit) away from the open web by using alternative technologies. We're better off with EME than Flash and Silverlight, essentially.
I'm obviously grossly over simplifying things, but what I'm trying to say is that I think you're right, it's not as black/white as the parent article tries to make it. I'm not trying to pretend I'm some sort of expert on this topic – far from it – and certainly recommend anyone interested in this to spend some time and actually read the reasoning of both sides.
The reason I'd still pay Netflix, is that I can already pirate all of the shows they license. I pay for their reliable adaptive-rate streaming technology, the content I can get from almost anyone. In trade for the convenience, I lose quality because the widevine streams only go up to 720p. Even sadder, I could torrent good quality screencaps of the 1080p Netflix streams if I wanted to.
The publishers are just being ridiculous, so the DRM is enabled for everything. Though I wish they would put their money where their mouth is and disable the DRM for Netflix originals.
Defective by design seems to be misinterpreting the "build the web for the users first" quote here, because the alternative to this proposal is not "no DRM", the alternative is a worse UX from a plethora of more hostile, wider reaching proprietary DRM implementations.
There's a time and a place to fight about DRM vs. no-DRM , but it's not here, this is the fight about how the DRM we will inevitably get works and interoperates.
The danger will be in it becoming normal for everyone to use EME, or that the most used audio/video devices and tools will by default enable this and make it hard/impossible to disable it. So if you shoot a video of police violence with your phone and decide to publish it that it can be blocked by e.g. government. Of course, pushing for integrating this with your video camera will be done to protect the children.
To make it acceptable they made it optional. But in practice all major browsers implemented it.
The right answer is now to standardized the W3C CDM black box by standardizing DRMs as ETSI has started (https://lists.w3.org/Archives/Public/public-html-media/2014F...). W3C should contribute to this effort.
Useful link on EME: https://www.w3.org/2016/03/EME-factsheet.html
EME doesn't define the critical CDM component required for it to actually work. It's like a spec for `<object type="application/x-shockwave-flash">` tag saying it defines Flash.
So in practice you still have to license CDM integration from Google (for Chrome's CDM only) and Microsoft (for IE's CDM only) and Apple (for Safari's CDM only) and Adobe (for Firefox's CDM only).
EME makes it possible to view the DRM'd content (that is there with or without EME) without installing horrible and unaccessible generic binary add ons (Silverlight, Flash) and thus gives more freedom to users. Now a Netflix heavy user can choose to consume the content on Linux, too.
Will DRM black box plugin threaten the security of my laptop? Will many mainstream sites stop working with IceCat?
Would anybody mind remembering me what we're going to gain on top of them thanks to DRM in the browser?
We build the web, not corporations. We control the web, not corporations. Let's just take the power away from them and put their egos in check.
The population at large mostly has a say by deciding which browser they use, and as long as people use DRM-friendly browsers, DRM is what they'll get.
Truth is it's a mix. Mozilla, Google, Microsoft and Apple are corporations of people who's influence is small and meaningful just like yours or mine.
When I read this article it seemed to suggest that the W3C is not fitting within this mostly open society.
History has shown us that DRM benefits only the largest richest and most single-minded corporations, and usually at some detriment to the user.
The problem here is that 3/4 browser makers are also DRMs makers (Apple, Microsoft, Google) and are also the biggest W3C donators.
> because the alternative to this proposal is not "no DRM", the alternative is a worse UX from a plethora of more hostile, wider reaching proprietary DRM implementations.
Good. Everything which makes DRM easier to implement, more reliable/stable/cross-platform/interoperable/etc., more streamlined and simpler to use, just skews the cost/benefit in the wrong direction. Everyone should be Free to make whatever DRM system they like, but such anti-social behaviour shouldn't be encouraged, and I certainly don't want to see organisations (FSF, Mozilla, W3C, etc.) making that activity any easier.
Plus, the harder it is to obtain and set up a working DRM system, the easier it will be for me to avoid it. For example, online tracking is very easy to accomplish, and is supported by many Free Software browsers, which means I have to spend time maintaining black/whitelists, selectively enabling JS in NoScript, deobfuscating and reading through JS source, etc. to avoid it. In comparison, Silverlight and Flash can be avoided very easily by not installing them.
Consider an analogy to proprietary software. It still exists, everyone is Free to make it, and many say it has a better UX. That doesn't stop me from running pure Free Software systems. If, say, the FSF had caved in years ago, and accepted some proprietary software, then my choice to avoid proprietary software would have been much harder since I'd have to disentangle such blobs myself.
The point of the GPL is to make Free Software easier to write, without benefitting proprietary software.
> There's a time and a place to fight about DRM vs. no-DRM , but it's not here, this is the fight about how the DRM we will inevitably get works and interoperates.
If you've given up that's fine, but please don't get in the way of those of us still fighting.
But we're going to have a plethora of proprietary DRM implementations, each self-important vendor writing their own plugin targeting the EME API. And end-users will still have to track-down the correct combination of architecture and OS for each plugin, except multipled now for every streaming-media vendor that they use.
For example, look here at the most-deployed DRM plugin currently available:
https://www.widevine.com/supported_platforms.html
Nothing available for *BSD, Sailfish, FirefoxOS... whereas current users of those platforms at least have Flash.
The W3C's argument is that without EME, DRM-protected media will move off the open web into its own app-silos. But that's exactly what will happen with EME, too, except the apps will be hosted within browsers.
Wouldn't this be a good opportunity to draw the line with browsers-for-the-open-web and apps-for-secret-stuff?
Welcome to the new world where depending on the number of users your system has, some websites will work and others won't. If its worth for the company to develop to your platform, you might be worthy the time. If not, well, thought luck, go out and buy a platform which is supported.
Games has had this wonderful (sarcasm) idea of platform exclusives. Publishers could not do that with flash, but with unique DRM platforms for each site, its both convenient and easy. Wonder how well Mozilla and Google can compete in that space with Microsoft, an entity well experience in platform exclusive dealings.
> Welcome to the new world where depending on the number of users your system has, some websites will work and others won't. If its worth for the company to develop to your platform, you might be worthy the time. If not, well, thought luck, go out and buy a platform which is supported.
If you're implying that the world wasn't like this before, you're simply wrong. I was unable to give good faith recommendations of Linux systems to people for _years_ because Netflix wouldn't run on them, at a time when Netflix access was important to pretty much everyone I knew. This only really changed after mobile devices became ubiquitous and thus more or less obsoleted the complaint.
Holding up silverlight as an example of a closed source plug-in that works on Linux is a terrible one, given how long it took for that to be the case.
The EME stuff is a proprietary plugin by any other name. If evil Corp wants a root kit for you to watch movies evil Corp gets one. There is zero difference between EME and other plugin systems from the pov of the vulnerablility it exposed your system to to the depth it can infect your OS to enforce itself.
The internet does not belong to those people, it belongs to us. It should remain free and open and sane. A monopoly by giant corporate media conglomerates is not inevitable.
But they didn't! EME is a spec for only for inputs, and no outputs.
EME entirely depends on CDMs, and their interface is deliberately left completely undefined (W3C uses that as an excuse to say they didn't—strictly speaking—define a DRM).
Plug-ins at least had an open NPAPI interface that anybody could integrate with. CDMs don't have any public interface. The spec allows them to be anything, including kernel modules or hardware (and in practice they're… plug-ins).
So now it's illegal under DMCA to write your own browser that plays EME-protected video with CDM compatible with Chrome's, Safari's or IE's.
It's a loss of freedom, and no DRM has been removed or even relaxed in the process.
On mobile platforms, they generally are system-integrated (and hardware-supported) components, often running at privilege levels exceeding the running Android/Linux kernel.
See the recent Qualcomm case where a DRM component (Widevine) running in TrustZone context[0] was used to attack Android's full disk encryption scheme.
[0] TrustZone is an ARM architecture feature for running code in a different execution context not accessible from the "normal" running kernel. Useful for running small amounts of code dedicated to protecting crypto keys, but horrible if you load gigantic DRM blobs into it that no one could reasonably audit due to sheer size even if their source code was available.
Linux has flash, it has silverlight, it has java. In the beginning they worked terrible, but thanks to the effort of open source developers, sooner or later it they got ported. When each publisher has their own DRM platform, copying the business model of the console market and earning money on the concept of exclusivity, how many open source ports do you expect to see?
On the other hand, almost all DRMs were broken because the content is available in clear: http://betanews.com/2016/06/26/chrome-drm-streaming-video-fl... https://iseclab.org/media/uploads/zotero/Steal_This_Movie_-_...
It's duplication, not transfer, so "sharing" is a more appropriate word than "stealing".
> I'm sure it's in the contract of every streaming service that they have to protect the licensed content to the best of their ability.
I've also read many EULAs which contain onerous terms; contracts don't need to be agreed to, and negotiations are a two way street. We need more of http://news.bbc.co.uk/1/hi/entertainment/2843069.stm and less of https://www.theguardian.com/technology/2011/nov/14/bbc-hd-dr...
> need to license content to survive
> Considering almost half of all bandwidth (in the US at least) is used for streaming, I'd say it's pretty important to have a well-defined solution to enable streaming companies to do what they need to do.
Streaming companies don't "need" to do anything. If they truly "need" DRM to exist, then they should shoulder that burden themselves rather than coercing others into doing the work for them; especially organisations and structures governing the Web, which was created specifically to disseminate human knowledge.
If that's too much of a burden for media companies to handle, then they should bow to market forces and close down. Humanity has survived perfectly well for millenia without them. Perhaps that will help divert some of the entertainment industry's billions towards causes of some actual importance.
There are a few schemes, which normally do not even count as DRM, that is intended to protect copyrighted material. Encrypted TV channels is a primarily example. A streaming service could copy that scheme, but delivery physical tamper-proof boxes that do key-exchange every few minutes is quite expensive. Alternative they could what YouTube/Twitch do, which makes copying a stream about as difficult as downloading a pirated version from a torrent site (ie, you need to use a third-party software). For movies, it is the best protection as you can get without having to distribute physical boxes.
They shouldn't because it is useless. DRM can always be circumvented.
> it's in the contract of every streaming service that they have to protect the licensed content to the best of their ability
This is the only reason why DRM exists: Stupid, greedy rights sellers. They don't care why or how people consume the media. They only see licenses and money. "Protecting" licenses equals protecting money for them.
DRM is not bad because I want to "steal" anything. It is bad because proprietary software with the main goal of restricting its users leads to a bad experience. Amazon Prime Video for example is horribly buggy and hard to use. If I could use a decent player, I would pay more money for the service. Both sides would benefit from no DRM, but greedy rights sellers don't have logical thinking in their toolbox.
I'd be surprised if that were true. (Do they donate anything? I'd be surprised if they did, I suspect they merely pay their membership dues.) The membership fees come at five levels, mostly dependent upon annual revenue; Apple, Microsoft, Google all pay the same as Adobe, Boeing, Dell, Facebook, HP, LG, Netflix, Siemens, Sony, Disney…
Standards are very important. But the way we make them is still highly improvable.