
Chrome 55-57 showed “download” button for all HTML5 media - sriku
https://bugs.chromium.org/p/chromium/issues/detail?id=675596
======
mtanski
Is there an extension that brings this button back?

I know publishers hate this, but publishers don't exactly have a good track
record of treating their user well. Non-copyable text, hijacking right click.
Regardless of how they feel it's all workaroundable (inspect) but still a
hostile user experience.

~~~
jug
I use to ensure devtools > Networking is open when I press play (or reload the
tab if it's autoplaying). If it's streaming the timeline should make it
obvious which resource it's about. Then just right click on the item and "Open
in new tab" or even Save (I don't remember if it's an option). When in a new
tab, just save the page as the page will be the media file itself.

~~~
Silhouette
FYI, this level of interference is trivially circumvented using several of the
possible alternative methods for serving video, even without applying actual
DRM wrappers.

------
shmerl
Sorry to burst the bubble, but this is nonsense. If you don't want something
to be downloaded, don't put it on-line.

~~~
izacus
> Sorry to burst the bubble, but this is nonsense. If you don't want something
> to be downloaded, don't put it on-line.

Or lobby really hard to implement DRM into browsers and lock down all devices
allowed to access internet right? :P

~~~
fdsafEWSF4yt654
Throwaway account

The mean reason why DRM will be used in HTML5 will not be for media but for
advertising.

Blocking ads will then be targeted as circumvention of DRM.

Google et all must be drooling at prospect of unblockable ads

~~~
bastawhiz
How exactly does the DRM work when I refuse to download the DRM-protected
content? That's like saying I'm circumventing DRM by not renting movies to
watch in my Bluray player. Your comment is nonsensical.

~~~
cookiecaper
That's an easy one. Construct the page so that the client can't tell the
difference between real content and ads. There's no inherent reason ads have
to be served from ad-specific domains or downloaded into HTML elements that
are detectable as ad space. That requires you to download the whole package,
including ads. Then, when the client attempts to analyze the content before
display, it could potentially be construed as "circumventing DRM".

Pre-legal speculation disclaimer: IANAL.

They'd have to define DRM as not only preventing ripping the video outside of
its normal context but any type of alteration prior to display, even if it
occurs after the encryption module terminates. That'd be hard because the
decoder ordinarily makes some alterations to the decrypted video stream, e.g.,
scaling for different displays, overlaying subtitles, applying filters, etc.

HDCP is intended to make DRM circumvention apply to any intermediary devices,
like capture cards, but that wouldn't work for computers since HDCP is just
working between the display and the GPU driver, if it supports HDCP; the
program used to playback the content would be unconcerned with this.

Again I'm not a lawyer but I don't see how blocking ads could be construed as
counteracting DRM, as long as the analysis is occurring after the normal
decryption cycle.

The wiggle room for publishers is probably in whether or not destroying the
ads creates a "derivative work" or not. The consumer's argument that the page
is not saved and displayed only temporarily would probably not work due to the
RAM copy doctrine.

Things like the Family Movie Act [0], which was passed in 2005 to pre-empt a
lawsuit filed against ClearPlay, a DVD player that provided fast-forward and
mute macros to bypass objectionable content in legitimate DVD copies, would
not apply since they explicitly authorize "making imperceptible [...] limited
portions of the audio or video content of a motion picture [...] for private
home viewing"; scope limited to motion pictures only.

Ad blockers have been challenged several times in European courts, where
they've won, but I don't see how they could expect to win a copyright
challenge in American courts (beyond blatant judicial activism).

My assumption is that big shots like Google have not pursued this yet because
they're more worried about the Streisand Effect than allowing relatively
advanced users to install ad block. Knowing that the blockers are legal in
Europe, there's probably nothing they could do to stop people from using them,
and it'd just create a huge PR issue.

Maybe the DRM angle is intended to get European courts to rule against ad
blockers? I don't know.

[0]
[https://www.copyright.gov/legislation/pl109-9.html](https://www.copyright.gov/legislation/pl109-9.html)

~~~
izacus
Modern "upgrades" of the DRM have completely locked out any kind of
modification from the source to the destination and prevent you from even
drawing over the content on screen.

I'm talking about the AACS 2.0 Blu-Ray DRM format, which requires you to have
a compilant BR player, compliant motherboard with DRM support, compliant CPU
with DRM module (!), compliant GPU, AVR and display. All of those components
are built to lock you out from modifying or capturing the picture stream from
BR to the display itself.

With the draconian craziness of DRM and widespread support for it (even here
on HN), it's easy to see this kind of lockout being deployed on the web as
well, especially if that allows advertisers to shove more ads in your face
without the possibility of using an adblock.

~~~
cookiecaper
While that's true for hardware Blu-ray players, I don't see how it can hold
for Blu-ray players that run on a PC.

------
ec109685
Addressed here:
[https://developers.google.com/web/updates/2017/03/chrome-58-...](https://developers.google.com/web/updates/2017/03/chrome-58-media-
updates#controlslist)

------
redm
tl;dr The download button removes a small barrier that users currently have to
save HTML 5 content. The size of the barrier depends on the media but the
justification on the part of the content owners/creators is the same: protect
the value of the content or the website it was published on.

While the concerns are valid, if history is any teacher, technology will march
onward and we'll soon have download buttons on all HTML5 content, one way or
another.

~~~
Silhouette
_The download button removes a small barrier that users currently have to save
HTML 5 content._

It didn't just remove a small barrier, it _actively invited_ people to
download and save the content. That's a very different thing.

~~~
Endy
Yes, it's the only positive thing about Chrome and HTML5, really.

~~~
Buge
And the ability to play video without being exploited by Flash vulnerabilities
is not a positive thing?

~~~
shakna
It's not a hell of a lot of change when the DRM blob that gets sent down the
wire is just as opaque.

~~~
caryhartline
I can only assume you're just posturing because the size and scope of Flash
and the size of scope of Flash's security problems are _way_ beyond just a DRM
blob.

~~~
shakna
> size of scope of Flash's security problems are _way_ beyond just a DRM blob.

Not sure about that, considering the Widevine's CVEs on Android have been
quite bad with privelege escalation and sandbox escaping.

A bad video can still be enough to burn your system. That's a full security
scope right there.

~~~
shakna
Just the source, because I hate unsourced claims.

[0]
[http://www.cvedetails.com/cve/CVE-2015-6639/](http://www.cvedetails.com/cve/CVE-2015-6639/)
\- Integrity Impact Complete (There is a total compromise of system integrity.
There is a complete loss of system protection, resulting in the entire system
being compromised.)

It is also worth noting that finding vulnerabilities may be a crime in many
jurisdictions [1] (thanks to the DCMA), which would prevent researching coming
forward.

[1] [https://www.eff.org/deeplinks/2016/03/interoperability-
and-w...](https://www.eff.org/deeplinks/2016/03/interoperability-
and-w3c-defending-future-present)

------
mrkgnao
> We disable right-click on our work

Ugh.

~~~
seanp2k2
Really wish browsers didn't allow overriding mouse events, or it was a
permission that you'd have to grant for a site ("this site is attempting to
modify the behavior of the mouse, allow?").

~~~
the8472
In firefox you can shift+rightclick to override site behavior. There also is a
preference to disable the events completely.

------
sriku
The download button would be totally justified ;) if Google added it to all
youtube content too.

~~~
hollander
Now DRM is working for Youtube, they can safely add that button.

~~~
slhck
Do you have a reference for this? By “DRM”, are you referring to EME?

------
HenryBemis
No offense folks but InternetDownloadManager FTW!! (or GetRight)(or any of the
many FIREFOX addons)

(not affiliated, just a happy user for many years)

~~~
joshschreuder
I'm surprised IDM has been updated for so long... I paid for it many years ago
and have been getting free updates for this whole time, all on the same
license.

------
niftich
I remember this appearing, and I recall other contemporaneous threads asking
how to make it go away, but I can't find the reference in the Chrome 55
release notes that this would show up: not in this friendly blog post [1], not
in this release blog post [2], and the source control log [3] is still
loading....

[1]
[https://developers.google.com/web/updates/2016/11/nic55](https://developers.google.com/web/updates/2016/11/nic55)
[2] [https://chromereleases.googleblog.com/2016/12/stable-
channel...](https://chromereleases.googleblog.com/2016/12/stable-channel-
update-for-desktop.html) [3]
[https://chromium.googlesource.com/chromium/src/+log/54.0.284...](https://chromium.googlesource.com/chromium/src/+log/54.0.2840.98..55.0.2883.75?pretty=fuller&n=10000)

------
jaredandrews
Reading this bug report makes me feel uneasy.

------
imode
repeat after me:

"I will not share something I do not want others to mirror."

if you don't want us to gain a copy of it, don't host it. simple rule. if you
don't like it, choose another content platform.

~~~
Silhouette
I suspect that would have killed every advance in making audio and video
content easier and cheaper to access for millions of people from the past
decade.

------
Mahn
Reminds me of the time when they removed the "arrow" buttons on the scroll bar
on Windows, or when they randomly decided to apply a lot more whitespace to
bookmark menus. In both cases they had to backpedal, because Chrome is just so
essential to so many people that even the tiniest change breaks somebody's
workflow. At this point Google should probably just fork Chrome and make
another browser where to test all the changes, big and small.

~~~
Franciscouzo
Chromium?

~~~
floatboth
Chromium is not a fork of Chrome, it's the other way around. Chrome is a build
of Chromium with branding and some blobs added.

------
problems
Did they actually remove this? Probably the only pro-user thing I've heard of
chrome doing in its entire lifetime.

~~~
elithrar
You're exaggerating, right? Chrome isn't perfect, but pushing automatic
updates, ongoing security improvements and UX (mixed content restrictions,
marking plain HTTP "not secure", etc) are just two of the very user-friendly
things the Chrome team have delivered over the years.

~~~
problems
Not really the kind of thing I'm talking about - I mean users-vs-publishers.
Chrome and Google tend to favor publishers - being an ad agency and all.

------
andreyf
Proper solution is to use something like this:
[http://wwwhtml5rockscom.readthedocs.io/en/latest/content/tut...](http://wwwhtml5rockscom.readthedocs.io/en/latest/content/tutorials/streaming/multimedia/en/)

~~~
Dylan16807
So has somebody already written the code to save multimedia that does this, or
does it still need to be made?

~~~
andreyf
Only examples I have seen are closed source / available as services (e.g.
[http://en.savefrom.net/](http://en.savefrom.net/))

------
Silhouette
And finally a solution in Chrome 58:

[https://developers.google.com/web/updates/2017/03/chrome-58-...](https://developers.google.com/web/updates/2017/03/chrome-58-media-
updates)

Too little, too late for many of us, I expect. We switched to using MSE some
time ago, which provided a way to avoid both the download button and other
normal file-saving functionality showing up in the first place.

Ironically, the biggest problem with this wasn't the ability to download
itself, because of course that was always available to those who chose to look
for it in any major browser. The real problem in our experience was the
customer perception that because an obvious download button had appeared, it
was now OK to download and save content from video-based sites. Users,
understandably enough, made no distinction between a site-provided facility
and a browser-provided one when the change appeared, and just assumed the
terms now allowed it.

I'm honestly surprised that no-one seems to have tried to sue Google over this
one yet. It has upset a lot of people over the past few months, and in some
cases it must surely have cost site operators a significant amount of real
money.

~~~
aviraldg
Once content has reached my computer, it is mine to do with as I wish and
consume as I wish. If you choose to interfere with this, your site is BROKEN,
and I and many others would not use it.

~~~
Waterluvian
I can appreciate where you're coming from. It's now in my computer and you
don't get to reach in and control things on me.

But I'm not so sure that's actually fair and reasonable. If I rent you a VHS,
once it's in your house, is it your right to consume as you wish? Do you get
to make a copy to watch at a future date? Maybe I don't want that. Maybe the
contract I make with you is that you can purchase a loan of this VHS to watch
over the next few days.

Maybe when I host your favourite music videos, I don't want you copying to
your disk to watch hundreds of times without seeing any ads.

~~~
Turing_Machine
Why should enforcing your wishes (or even your contractual agreements with the
viewer) be Google's problem?

~~~
Silhouette
Enforcing your wishes isn't Google's problem, but actively interfering in a
commercial relationship between two other parties might be.

