Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Reconciling Mozilla’s Mission and the W3C EME (andreasgal.com)
186 points by fabrice_d on May 14, 2014 | hide | past | favorite | 191 comments



This is terrible news from end to end.

To solve it, we need to tackle the root problem and not blame the browsers: those who want to infect our open web with DRM.

Cancel your Netflix subscription. Let them know why. Same with Hulu. Same with amazon video. same with anyone who tells you to that your open web is less important than their unwillingness to embrace the new, digital frontier.

Don't give money to the asshats who push this crap. Simple as that.

This is only the beginning if you let them in. What will you accept next? Drm infected Images? HTML infected source which can only be decoded on windows? This is not the end. The line must be drawn and it must be drawn now.


Canceling your streaming service subscriptions won't be sufficient, even if everyone did it.

You have to stop consuming Hollywood content. Stop going to movies. Stop watching TV shows. Stop listening to recorded music.

Then you might actually make a difference.

The streaming services are just stuck in the middle here -- Hollywood won't sell them, or anyone, content without DRM.

DRM actually makes sense for a streaming service, where you only have a temporary license to the content anyway. You're buying the right to watch or listen one time -- how is that supposed to be enforced?


You talk as if there is no other way to consume film content on a computer...


As discussed below, DRM never makes sense since it's not effective anyway.


You live in a very sheltered bubble if you think DRM is not effective.

For most people, DRM is enough to stop them. It's only a select few people with a deep understanding of technology who can defeat even the most basic DRM.


> For most people, DRM is enough to stop them. It's only a select few people with a deep understanding of technology who can defeat even the most basic DRM.

I don't think you get the point. Most pirates never try to beat any DRM. They pirate what other capable few provide to them DRM free. Yes, some initially break that DRM. But it takes one knowledgeable pirate to do it in order for the rest to get it DRM free ever since. So, going back to the point above - DRM is not effective for anything except degrading the product for legitimate users.


This is only the case if you try to get the content legitimately (i.e. pay for it). Consumers without scruples have an easy ride.


Start pirating content. Punish them in their pockets. It's all their care about.


So long as you're still consuming it you're still propagating the resulting culture, and encouraging other people to pay for it. Not everyone is in a position where they can so easily choose to flaunt the law.

It's best to support liberally licensed things and other alternatives; then your friends and family can share in them without taking the bigger step of choosing to ignore the law.


I think it's worse than that: DRM is serving a market of users ASKING to pay a lower price for renting movies instead of buying them. Many users are very happy to trade freedom of sharing with cost, and I personally don't think you can expect a business model based on an agreement of sharing restrictions to work without any layer of technical enforcement.

Even outside of movies, there are surprisingly few examples of successful artificial restriction policies without any kind of enforcement. Socially, people assume that they will be physically restricted from doing things that they are not supposed to be doing (from key locks to bank safes to packaging boxes with safety labels to bodyguards to keep out signs to whatever). I'm not sure it makes sense to go chicken/egg here: we can simply accept that people expect restriction policies to be enforced somehow, and they find totally reasonable that there is some kind of enforcement.

The whole business model of movies is based on restricted consumption; you pay more to get a better experience (e.g.: more quality) or less restrictions (e.g.: buy instead of rent). You can't expect this to continue to exist without a technical enforcement, and at the same time you can't expect Hollywood to come up with a radically different business model for a mature industry. You need disruption to arrive from somewhere else.

IMO, fighting against DRM for movies is ignoring the big picture. There are absolutely zero possibility that you will be able to experience Hollywood digital movies without DRM, because people accept and DEMAND to be restricted in order to access to discounts. The only alternative that makes sense is to boycott Hollywood and finance an innovator that can setup an alternative movie industry not based on restricted consumption (and good luck with coming up with a workable, scalable business model; that would easily make you billionaire and it's thus quite hard to achieve).


While I share your sentiment and never use any DRMed services to vote with my wallet, the critical mass of users don't care. It gives an ability to crooked publishers and distributors who oblige them to get away with unethical practices like DRM.


has that ever worked? (honest question)


It is naive to expect that decrypted media stream will ever be leaving CDM module as so optimistically shown on that illustration.

Microsoft dropped and neglected a bunch of great features when shipping Vista, but it went out of its way to drag Protected Media Path into it. PMP is fronting a major industry effort to create trusted software and hardware framework that on one end accepts encrypted stream and on other draws video pixels on the screen, all the while showing a middle finger instead of raw data to the user on whose system this whole circus unfolds.

It will be laughable to think that CDM won't be PMP-based. Getting access to the raw data with CDM in picture is a pipe dream. Mozilla, sandbox, open source - no matter. CDM exists to prevent raw data leaks.

http://en.wikipedia.org/wiki/Protected_Media_Path


This concerns me. Amazon Prime Instant Video requires HDCP via Silverlight. Support for this is pretty much non-existent in Linux drivers, so watching Prime video via Pipelight is limited to standard definition (no HD).

I worry that with EME/CDM will come a requirement for HDCP on other services such as Netflix. Inconsistent HDCP implementation will be another thing to fight on the video driver compatibility front (and let's be honest, I don't give a crap about HDCP support - it's a flawed system that assumes every user is a pirate).



It will be laughable to think that CDM won't be PMP-based.

Even on Linux and OS X?


Edit: It's said to be a downloadable extra at user option.

The Moz page description of the sandbox says the CDM won't have any system access, so it could not distinguish whether PMP is there or not, except maybe by flags in the input from the browser. So either the Mozilla sandbox-CDM can't work as described or PMP won't be required.

Someone correct me if I've missed something there.


So were about to see Iceweasel fork a bit more from base firefox and add a button to render the "encrypted" content to file?

10/10 media industry, you guys are just the absolute best about sticking your fingers in your ears and singing lalala while substituting reality with your own where electrical charge isn't replicable.


and in the near future this should allow us to retire plugins altogether.

I don't see this as a universally "Good Thing".

The Web has evolved to a comprehensive and performant technology platform and no longer depends on native code extensions through plugins.

You mean the Web has evolved into a Doctor Frankenstein's monster like hodge-podge of kluged together hacks, layered on top of layers of other hacks, layered on top of still more hacks, in order to make a Web Browser a poor man's operating system.

So if we can extend our operating systems by installing programs, why shouldn't we be able to extend our poor man's operating system by installing plugins?

I'm assuming this is referring to killing of NPAPI and not other "extensions" mechanisms, but it seems (from what I've heard here and there) that people are mostly proposing to replace NPAPI with "nothing" or with less powerful APIs that would limit plugins significantly.


Replacing unsandboxed plugin APIs like NPAPI that can directly access the OS with sandboxed plugin systems like NaCl and emscripten that support sandboxed native code seems like a major improvement. The browser is quite enough attack surface area; let's not expand it further by having plugins.

That said, while the article's described sandboxing approach to EME works better than the alternatives (assuming content providers will support it), that's a lot like saying "at least the arrow through your eye wasn't on fire". Gee, thanks.


Don't get me wrong, I'm not saying we should keep NPAPI around forever... and I acknowledge security as a legitimate concern. But power and extensibility are legit concerns as well, and I worry about an overly restrictive environment where the evolution of media on the web is forced into lockstep with the evolution of browsers, without even the option of going "off the reservation" and using something radically different.

Of course, at the end of the day, this is one HUGE advantage of OSS, and with many of the major browsers being OSS, someone could always fork a browser with whatever kind of plugin support they want if they really need it (and are able to support it).


> Replacing unsandboxed plugin APIs like NPAPI that can directly access the OS with sandboxed plugin systems like NaCl and emscripten that support sandboxed native code seems like a major improvement.

Until you want to write a plugin with a legitimate reason to directly access the OS.


Legitimate reasons to directly access the OS are typically "there isn't a browser API for this yet". We have multiple Open Source browsers now; submit a patch to one or more of them to add a new API, and ideally start working to standardize it. The result will be far better and more secure than a one-off custom plugin to pass through specific OS functionality.


If Firefox had an API that allowed you to do anything the OS allows you to do then there would be no sandbox. If it doesn't then there are things you can't do with the browser API that you could do with direct access to the OS.


But the goal is not to do everything that native applications do, but instead provide features to users. Here's an example: lets imagine it's 2005. You have a native application that stores 1 GiB of data to the disk for caching of media assets. Now you would like to reimplement that as a browser app, but there's no browser API for disk access. What's the solution? You could provide a browser API for direct arbitrary disk access, but that's clearly not secure enough. Instead, File API was created with a lot of restrictions compared to the api that the operating system has.

If you think it this way, you can go extremely far in replacing native applications. I guess the core problem is that OS APIs were not designed to execute unsafe code, but browser APIs are.

Ultimately, there's no application-level feature that couldn't be implemented with a well-designed browser API.

In addition, I like it that browsers are creating new APIs relatively slowly. The reason is simple: security is difficult, and there's time to actually think about security issues.


Browser extensions in Chrome, and particularly in Firefox are very expressive. Things that might have been designed as plugins in the past could be written as extensions.


Yes, step right this way to begin the 10 year+ w3c standardization dance, with a high likelyhood that large vendors never implement the functionality anyways.

Web standards and the web standardization process are broken.

An example is webrtc, which was practically designed for webcam chat, yet this is still completely broken in a cross platform/browser context years after the fact.


Don't try to standardize it first; work with Mozilla and Chrome, add an experimental API, and then take the resulting API to WHATWG (preferred) or W3C for standardization.


> You mean the Web has evolved into a Doctor Frankenstein's monster like hodge-podge of kluged together hacks, layered on top of layers of other hacks, layered on top of still more hacks

So it's like every other successful platform in history, then.


You make a good point. :-)

Somehow it seems worse with the Web to me though, but maybe that's just because it's so ubiquitous and used for such a variety of things.


> So if we can extend our operating systems by installing programs, why shouldn't we be able to extend our poor man's operating system by installing plugins?

IF we can extend our operating systems. Do not take that for granted, and not for too long.


Nothing prevents mozilla if they would want to add a warning box similar to self-signed certificates every time a website tries to access DRM code outside the users control.

It would serve the goal of objecting to the EME, while users can continue to access all content they want. It would also put the responsibility to the website if the black box called DRM causes problems, locks up, or cause havoc on the user. Third, it allows users who do not want DRM to hijack their machine to explicit express their approval before such code is executed.


This is exactly the situation today with Flash. Click-to-play is akin to a warning. Users are somewhat aware Flash causes problems, locks up etc.


>We have come to the point where Mozilla not implementing the W3C EME specification means that Firefox users have to switch to other browsers to watch content restricted by DRM.

Then so be it. If Mozilla's mission is to improve and defend the "open" web, then EME should never have been considered for implementation. They shouldn't sacrifice their goals for the sake of market share.


Improving and defending the open web is not just about fighting the good fight on DRM. The Mozilla mission also calls for us to fight for users right to make choices[0] as well.

Mozilla could choose not to implement EME, and draw that line in the sand, but that means denying users the option of continuing to use Firefox to access content they choose to access.

My preference (both as a long time Firefox user, and a Mozillian) is to see Mozilla allow me to access content, and continue to support the Mozilla mission rather than switch to an alternate browser to access content[1].

[0] http://www.mozilla.org/en-US/about/manifesto/ [1] PS... you can argue that I shouldn't access encumbered content, but you are wasting your breath (or bits) ;)


Sure, the user may want to access DRM-encumbered content, but we shouldn't promote such a thing. You're not denying the users anything by refusing to implement EME, the media companies are denying the users freedom by insisting on using malware to deliver content! Just because users want Netflix in Firefox doesn't mean that it's the right thing to provide.


The problem is nobody actually understands how digial media works. They have lived for decades now where on personal computers audio and video were scarce resources you got through curated gatekeepers.

Whenever I just copy stuff between computers everyone in my extended family is bowled over. It is literal shell shock to find out that this stuff is literally electricity that you can do whatever you want with if it isn't behind uncrackable encryption.


Is supporting a EME the same thing as promoting it?


One does not preclude the other, no.


> Sure, the user may want to access DRM-encumbered content, but we shouldn't promote such a thing.

You should support (not promote) doing it within Firefox if you want users to continue to use Firefox; you could even do so with a UI that provided security warnings associated with the use of W3C EME, which would discourage users from doing it, but not make Firefox an non-usable browser for people who do choose to consume that kind of content.


You're not denying the users anything by refusing to implement EME, the media companies are denying the users freedom by insisting on using malware to deliver content!

These are the same companies which are refusing to deliver content to Linux and open platforms today, which will continue to do so in the future.

But now they can claim it's standards-compliant so it's the open-platforms which has a problem, and not them!

This thing clearly stinks.


| You're not denying the users anything by refusing to implement EME

Mozilla is if they claim to be an open source, standards based browser that promotes user choice.

If Mozilla doesn't adhere to standards, and users are denied content because of that, then Mozilla cherry picking standards is explicitly denying users their choice.


So, a doctor that doesn't offer injections of carcinogens is denying patients their choice?


"Firefox is about empowering users, unless those users should be so bold as to do something that's totally bad for me–I mean, them"


Please explain. In what way is it totally bad for davexunit?


The logic seems to be that if Firefox supports EME, that movie producers will be able to switch to using it without business pressure to release completely DRM-free versions of media.

It's an argument I'm partial to myself, having run a Linux box for more than a decade, but it's still an argument based on self-interest.


You think most users will care if it ships EME or no? Like seriously?! I'd love to live in that world.

Basically if Netflix doesn't work with Mozilla who's gonna be blamed? Netflix that works on Chrome? Google, whose browser plays Netflix or Mozilla that doesn't open Netflix? If you answered Mozilla, you live in real world :(

No, this one is squarely on shoulders of those that supported that damned crud of W3C standard.

If Mozilla doesn't back this up, it will be marginalized even more and only Google, Microsoft and Apple will decide on the future of open web. And we all know what that will mean for the open web.


Who gives a fuck about Netflix? What percentage of the Internet population are ever likely to or are even interested in subscribing to Netflix/Hulu/Amazon Prime etc?

What grates me most is that if Mozilla was really targeting the developing world, as per their aims with cheap FirefoxOS phones, then there would be no need to implement this, which simply panders to the needs of first/western world media companies demanding DRM on their content.

I'm exceedingly disappointed with Mozilla for making this decision.


One issue here is that Mozilla's revenue and ability to influence decisions at the W3C may depend more strongly on their usage share in the "developed" world than the "developing" world... The W3C issue may be even more of a problem than the revenue issue.


Joe does.

Also I have no doubt that Google would DRM Youtube if that would: A) Prevent copyright holders from complaining B) Give Chrome bigger market share (or reduced FF to an outlier like Opera)

I'm not ambivalent, I'd like to see it as opt-in only, because DRM in Fx will be a major vector for viruses.


Think about winning the battle vs. winning the war.

Mozilla could draw a line here, and no further, and not implement EME. But the consequence might be that FF market share drop significantly, as "Mah netflicks don't werk."

Suddenly Mozilla lose a large amount of revenue, development is scaled back, and the relevance of FF is reduced. Eventually FF is marginalised and Mozilla no longer involved in discussions about the future of the web. I think everyone would be disappointed if that happened.

The issue here is that the W3C is trying to push a round peg into a square hole. Laws passed by governments are in opposition to reality, and the only way to solve the problem at hand is security by obscurity and 'trusted' devices.

While it's noble of Mozilla to resist change of this type, it's fighting an uphill battle against legal precedents and legislation that is trickling down into technology. I don't think it's a battle that winnable until changes are made to IP frameworks the world over.


But the consequence might be that FF market share drop significantly, as "Mah netflicks don't werk."

Then maybe those users deserve the loss of their freedoms.


he consequence might be that FF market share drop significantly, as "Mah netflicks don't werk."

You mean like it already doesn't in most of the world, because of arbitrary geographical restrictions?

I can't see this causing noticeable damage.


"...Firefox users are at risk of not being able to access DRM restricted content (e.g. Netflix, Amazon Video, Hulu), which can make up more than 30% of the downstream traffic in North America."

While this statement is factually accurate, using the file-size of a type of content as a measure of relevance should be of little relevance to the discussion.


Netflix is considered the main driver behind this DRM madness. In the context of Netflix, an often voiced reason for DRM is the fact that it rents movies, rather than sells them. Besides DRM being completely ineffective to prevent piracy, the concept of rentals itself doesn't make any sense for digital goods.

The core logic behind a rental (for physical goods) is reusability. Physical goods have a fixed cost of production per copy, so the price of selling it should cover that cost. Renting is expected to be cheaper than buying, because the object is returned to the renter which allows reusing it for new clients without expenses on another physical copy. I.e. most of the price in the rental case goes for the service of using it, and not for covering the cost of production.

With digital goods this whole premise doesn't apply. There is practically zero cost of producing another copy, so reusability is implicitly achieved with practically no expense by copying bits. And it also means there is no need to return the merchandise so it could be reused by others, since the merchant easily duplicates the merchandise practically for free. Therefore why would renting cost any different than buying? The whole concept of renting is illogical for digital goods. Therefore user can buy the digital merchandise for a (lower) price as paralleled by physical renting, while still retaining the ownership.

Netflix proponents claim, that they are charged per month to access anything, so in such context renting makes sense. But it still doesn't. They are charged for the service to stream the data. I.e. for convenience. It's cheap not because they need to return the merchandise so others could reuse it (as above). It's just cheap as is. There is completely no need to prevent users from retaining a copy once they watched it (i.e. which means buying). In order to it put in practical perspective, Netflix can be achieved without any DRM by selling each copy for some small price or / and charging a monthly fee for a convenience of streaming that data from the cloud while users could also keep those downloaded DRM-free copies all they want. I'd totally subscribe to such service. But I'd never subscribe to Netflix the way it is now because of DRM.


Claiming that rentals don't make sense in the digital age is focusing far too heavily on the technical fact of how digital data works, and completely ignoring the legality of things, including intellectual property.

If I make a movie and sell you a DVD, the terms of the sale prohibit you from, say, showing this movie in a theater to a bunch of strangers and charging them money. Yes, you own the physical DVD, but you don't own the intellectual property of the movie itself. This holds true for physical copies, and it holds true for digital distribution as well. You are purchasing the right to personal use of the movie (i.e. viewing), and that's it.

If you want to e.g. show it in a theater (whether or not you're charging admission), you have to purchase that right separately. And that costs a lot more.

In the case of rentals, the company that is doing the rentals pays for the privilege of renting out the movie, and the cost they pay is predicated on concurrent access to the movie being limited.

When it comes to digital rentals, limiting concurrent access to the digital movie file doesn't make sense. Users who rent things digitally expect there to be no wait. But in turn, they're only given access for a limited time. For iTunes, that's 30 days since you paid for the rental, and then only 24 hours since you started actually watching it. You can't rent a movie on iTunes and watch it every day for a month, because you don't have that legal right. You must pay for that privilege, which is to say, you must buy the digital movie.

For Netflix, the limited access to the movie is gated by you having an active Netflix subscription. The moment you stop paying for Netflix, you no longer have access to the movie. This again makes perfect sense, since you're paying Netflix for the right to access all of their streaming movies for the duration of your active membership. You are not paying for completely unrestricted access.

Unfortunately, due to the nature of digital content, the only way to actually enforce these legal restrictions is by use of DRM. It sucks, but it's a fact of life. This is true for rentals, and it's generally true for purchases as well.


> yes, you own the physical DVD, but you don't own the intellectual property of the movie itself. This holds true for physical copies, and it holds true for digital distribution as well.

This is really irrelevant. When you buy a book you also own the book, and not the intellectual property it contains. Same thing with files - you can own the file, but not the intellectual property it represents. So legally nothing is wrong with buying digital goods (files), while the intellectual property they hold is only licensed to you (and not sold). I don't see how it correlates with any necessity for DRM.

> But in turn, they're only given access for a limited time

I don't see a need for it. Limited time of rental is justified for physical goods. For digital it's not (I explained above why).

> his again makes perfect sense, since you're paying Netflix for the right to access all of their streaming movies for the duration of your active membership. You are not paying for completely unrestricted access.

I understand Netflix terms, what I question is their sensibility. You say it makes perfect sense. I don't see any sense in limiting access. Netflix can charge the same thing for unlimited access, plus allowing making backups and still make the profit (it can add a charge per file if they worry that users would just download the whole catalog at once).

> Unfortunately, due to the nature of digital content, the only way to actually enforce these legal restrictions is by use of DRM.

No, DRM can't enforce it (since this stuff is pirated practically instantaneously). So why is it used?


"No, DRM can't enforce it (since this stuff is pirated practically instantaneously). So why is it used?"

Strongly suspect this is due to contractual obligations with the studios.

The agreements will almost certainly stipulate that content must be sufficiently protected. Hence Netflix plays ball, if it wants access.


My question "why" was not pointed at Netflix. It was pointed at publishers (studios, etc.) which demand that DRM. They have no valid answer for that question.

While Netfilx aren't an ideological champion for DRM, they are a huge proliferator of it. Compare it to distributors which sell only DRM-free content and actually attempt to influence publishers to sell through them (like GOG for games). Those are actually doing something good! Netflix just help to spread the sickness claiming that "they have no choice". But that's a poor excuse.


It's a form of price discrimination. If you want to watch a movie once ("rental") it costs $5 but it you want to watch it unlimited times it costs $20. As a customer, I appreciate this because it allows me to pay less when I want less.


Why discriminate? Let's say users watch N movies per month on average. They can set average purchase price per movie at $20 / N, not at $5. That's it. They can combine the two to make it more even. Charge X per month for the convenience of streaming and Y per movie for the purchase (and aim to arrive at the same $20 / month roughly). All that doesn't require any DRM.


Because money. If 20 users are willing to pay $20, and 80 are willing to pay $5, Hollywood can make $2020+$580=$800 instead of $5*100=$500.


It's not $20 per film. Not sure what you are calculating.


It's an example. The exact price can be used in the same formula. Read https://en.wikipedia.org/wiki/Price_discrimination


I find such price discrimination to be a despicable practice, unless we are talking about differentiating prices because of different average level of income in those markets. And even so, regional discrimination becomes even less relevant in the digital space. The fact that such practice leads to resorting to unethical methods in the digital world (DRM) implicitly proves the point that it's crooked.

Related subject discussed on GOG: http://gog.com/news/getting_back_to_our_roots


I agree, but they have every financial reason to keep doing it. How would you convince them to sell one product for one price to everyone for less total money?


Usually such crookedness can be avoided if competition is high enough. I.e if competitors can be profitable without ripping customers off, they could do that in order to attract customers to their option. Seeing that they are losing customers, those who resorted to price discrimination start thinking about restraining their greed. Unfortunately when completion is weak, or all participants agree on using this crooked practice to keep the prices high (which should be illegal really), they get away with it.


one aspect of this - if you don't make an attempt to protect the content, even if it is "pirated practically instantaneously", then the studios can't go after anyone pirating their product in the legal system with any chance of winning. there is great fear of the slippery slope you go down in that world.


> if you don't make an attempt to protect the content, even if it is "pirated practically instantaneously", then the studios can't go after anyone pirating their product in the legal system with any chance of winning.

Why not? Absence of DRM doesn't make infringement legal. Studios can go after it the same way they do now. What they'll lose are various evil perks they get from DMCA-1201. But they weren't entitled to them to begin with. They all exist because of undemocratic and corrupted political process.


> When you buy a book you also own the book, and not the intellectual property it contains.

But a book is not a movie. You can't take your physical book and let 500 people read it simultaneously. So there's no need for even considering restrictions on what you can do with your physical book. The closest thing that comes to mind is scanning and re-printing the book 500 times and distributing that. And you can't do that. That's illegal.

> I don't see how it correlates with any necessity for DRM.

Because of the extreme ease of reproduction + distribution, coupled with the near zero chance of being caught, is a strong incentive to violate IP law.

> Limited time of rental is justified for physical goods. For digital it's not (I explained above why).

No you didn't. What you said has absolutely no bearing whatsoever on the validity of limited-time licensing of the right to view content.

> I don't see any sense in limiting access. Netflix can charge the same thing for unlimited access, plus allowing making backups and still make the profit

Hah, in your dreams. Netflix's ability to negotiate (with the content providers) for the legal right to stream content to you is predicated on there being limitations. The more unrestricted the access, the more they have to pay.

Not only that, but if you did remove all limitations (and restricting access to the duration of your membership is, of course, a limitation), then there would be no reason for people to stay Netflix members for longer than it takes to download and save all the movies they want to watch for the next few months. Subscribe for one month, download 6 months worth of movies, unsubscribe. Doesn't sound like a great business model, does it? But of course they couldn't do this even if they wanted to, because no content provider is going to give Netflix a license to re-license the content to Netflix subscribers in perpetuity.

> No, DRM can't enforce it (since this stuff is pirated practically instantaneously). So why is it used?

Because it's better than nothing. New content is pirated pretty fast, sure, but stuff doesn't stay easily available forever. Netflix doesn't deal in new content anyway (barring their recent ventures into producing their own content, which is a different discussion).

Without DRM, if I have a friend with a Netflix subscription, I can just ask him to grab a few movies and send them to me. Not only does this work even if the movies aren't easily available on BitTorrent, but it's also a lot safer because nobody can track this (whereas BitTorrent does have a non-zero risk of being tracked, or of quality problems, or fakes, etc). At this point it's about convenience. Make it hard enough or risky enough to acquire the content for free, and people will decide it's easier to just pay for it. And that's what DRM does.

Granted, DRM solutions do not work particularly well. But in the eyes of the rights-holders, it works better than nothing.

---

To clarify, I'm not an advocate of DRM. I would much rather get content without it. DRM-free content is more convenient to work with than DRM'd content. But there is a vast gulf between saying "I'd rather have DRM-free content" and saying "All content must be DRM-free". The former is something I can ask for. The latter is just wishful thinking.


> But a book is not a movie. You can't take your physical book and let 500 people read it simultaneously.

So what? Because you can make 500 copies doesn't justify using an unethical police state approach which DRM implies (i.e. treating all users as criminals by default). DRM is unethical by definition, because it's an overreaching preemptive policing. One would reject all DRM on the same ethical grounds one would reject police state approach to society.

That's besides the fact that DRM doesn't prevent any piracy, since it's broken practically right away and subsequent pirates never deal with it. Therefore this argument of copies is completely irrelevant to justify it.

> Because of the extreme ease of reproduction + distribution, coupled with the near zero chance of being caught, is a strong incentive to violate IP law.

Again, DRM has no effect on easiness of illegal reproduction (see above). It has nothing to do with incentives or fear of being caught. It's the same with or without DRM.

> What you said has absolutely no bearing whatsoever on the validity of limited-time licensing of the right to view content.

I disagree. If you have some point to present for the benefit of the discussion, address what I expressed above, otherwise we just affirm our disagreement.

> Not only that, but if you did remove all limitations (and restricting access to the duration of your membership is, of course, a limitation), then there would be no reason for people to stay Netflix members for longer than it takes to download and save all the movies they want to watch for the next few months.

Even that out with a fee per file. That would prevent downloading the whole catalog at once.

> Because it's better than nothing.

No, it's worse than nothing, because it cripples usability for legitimate users while having no effect on pirates.

> New content is pirated pretty fast, sure, but stuff doesn't stay easily available forever

On the contrary. Once it's pirated by the first pirates which scrape DRM, it becomes easily available practically forever for the rest of the pirates.

> Without DRM, if I have a friend with a Netflix subscription, I can just ask him to grab a few movies and send them to me.

Too much hassle for potential pirates when they can access the same with just a few clicks through P2P networks. The scale of such copying can't compare. Pirating through P2P is waay more massive than any potential copying from friends. DRM doesn't make piracy neither more risky nor more scary. According to some, DRM actually only increases piracy (see an interview with CD Projekt Red).

> Granted, DRM solutions do not work particularly well.

They work - to cripple the product for users who pay for it. Plus they work for whatever shady reasons those who push for those solutions came up with. They surely don't work for stopping any piracy.


You've drifted from your original claim that rentals don't make sense for digital goods, into railing against the effectiveness of DRM, while presenting your argument as railing against the idea of DRM itself. DRM is ineffective, yes, but that doesn't mean the concept is inherently bad. It just means the implementation is bad. It's certainly quite plausible that there is no way to produce good DRM, but that would be a different argument.

I'm not interested in debating the merits of implementations of DRM, nor of its morality (as it is quiet unlikely that an argument about the morality of DRM will ever sway any participant, as this is not a topic where logic and reason tends to apply).

If you want to try and argue again as to why you think the concept of renting digital goods doesn't make sense, feel free. But you'll have to go back and address my original reply again.


Two arguments combine and reinforce the conclusion that DRM is never needed. To clarify:

1. Rental of digital goods doesn't make sense for me (explained above).

2. Even if you can come up with sensible reason for rentals of digital goods, DRM is still ineffective so there is no point of using it anyway, which makes rental unenforceable which kind of makes it pointless even more and brings the argument back to #1.

> I'm not interested in debating the merits of implementations of DRM, nor of its morality

That doesn't fit with your statement that "that doesn't mean the concept [of DRM] is inherently bad". Unethical nature of it makes it inherently bad. Ineffectiveness of it in combination with always crippling the usability makes it inherently bad. Security and privacy threats it represents makes it inherently bad. Implementation is always bad because it's always aimed at crippling usability and treating all users as potential criminals by default. It's the definition of DRM. So there can't be a good implementation, otherwise it wouldn't be DRM anymore.

> as it is quiet unlikely that an argument about the morality of DRM will ever sway any participant, as this is not a topic where logic and reason tends to apply

Why not? Ethics has its logic. I explained in this thread why DRM is unethical. The logic is pretty straightforward and similar to how it's explained that police state is unethical.

There are two major objections to DRM - ethical and pragmatical. Both can be discussed and both have valid logic. I expressed that before here: https://secure.gog.com/forum/general/day_against_drm_1/post6...

So far I never saw proponents of DRM coming with any convincing arguments against either of those objections. They either claim that since many users are ready to accept DRM's overreaching policing it's not unethical, or they claim that DRM is actually doing something useful. Neither of that is convincing, because many users have no clue or don't understand the nature of DRM, so their acceptance doesn't mean much. And DRM is proved to be ineffective on the constant basis. I'm yet to hear any other argument which actually makes sense.


> Rental of digital goods doesn't make sense for me (explained above).

You mean "stated above". You never adequately responded to my comment, instead drifting off into the weeds of railing against DRM.

> Unethical nature of it makes it inherently bad.

You're taking it as a given that it's unethical. You haven't proved that yet, you merely made an analogy to a police state.

> treating all users as potential criminals by default

The perfect DRM would enforce the IP rights without interfering with legitimate use. Such a perfect DRM would not, in fact, treat users as potential criminals. Certainly not any more than, say, merchandise tags in retail stores. I doubt you rail against those.

What does treat all users as potential criminals is those unskippable FBI warnings at the start of movies. But that's not DRM.

Granted, DRM implementations in general are flawed, and those flaws do impact legitimate users. But that's not always true. For example, I wouldn't say that the DRM iTunes uses for movies/TV is crippling otherwise-legitimate uses. Which is to say, it's never stopped me from enjoying my movies or TV shows the way I wanted to. Granted, I've never wanted to watch my TV shows on, say, an Android device, but the ability to view iTunes content on an Android device is not something I purchased the rights to in the first place.

> Why not? Ethics has its logic.

And yet you haven't even attempted to use logic to defend your claim that it's unethical. You've just made sweeping generalizations and analogies, with the expectation that I would agree with you.

---

In any case, I did say I'm not interested in debating DRM, and I'll say that again. If you want to try to make an argument for why rentals don't make sense, using some justification other than "because rentals require DRM and I believe that DRM is unethical", go ahead (but you should go back and reply to my original comment, not this thread). But you don't really seem interested in defending that statement, instead you just want to talk about DRM. And I would rather not.


> You never adequately responded to my comment

Which one? About no bearing (I didn't see what to respond there), or about risk of users downloading the whole catalog at once? I responded to that (the service can charge some fee per file to prevent such thing). Or you mean about that Netflix has to negotiate something? The discussion wasn't about what is handed to Netflix by the publishers, it was about the concept of renting of digital goods which I find to be illogical. So please point me to the comment you want me to answer to, because I'm not sure which one that is.

> You're taking it as a given that it's unethical.

For me it is. I can expect that some people have different view and find it normal. After all some people find extreme Orwellian policing of society acceptable. It's not normal for me and never would be.

> The perfect DRM would enforce the IP rights without interfering with legitimate use.

Perfect policing system would prevent all crime without interfering with legitimate activity and without suspecting innocent people. I doubt such thing can exist. Increasing policing to extreme levels of total surveillance is not perfect policing because it equals to suspicion by default and it clearly interferes with legitimate activity. That's what DRM is. Overreaching preemptive policing.

I.e. the logic of DRM goes like this:

1. All users are potential thieves.

2. We need to prevent all of them from doing anything that is not authorized.

3. Let's build some technical measures and deploy them on users' systems and devices (since there is on other way to achieve the goals of #2).

4. Let's enjoy piracy free world.

They eagerly do #3, while #4 obviously utterly fails (it doesn't stop them from doing #3 for some reason as we discussed above). Now, I see huge problems with 1-3. Firstly, all users are assumed criminals. It's insulting and disgusting and it's not comparable to a lock on a store or tags like you said. Because of #3 - i.e. users' private digital space is invaded for the sake of deploying the enforcement of all these policies.

Imagine some police claiming, that all people in the country are potential criminals, so they need to invade all people's houses with police cameras to prevent any potential crime. That's what DRM does in essence. House is one's private area. One's computer / system / program one uses is one's digital private area. Invading it with preemptive policing measures is unethical and overreaching and prone to all kind of abuse.

> And yet you haven't even attempted to use logic to defend your claim that it's unethical.

See above, I expanded on my previous brief explanations which I assumed were sufficient.


> you can own the file, but not he intellectual property it represents.

So I'm allowed to distribute files I own freely, as long as I take the file extension off of it? Or the metadata?

I agree, the long string of the presence or absence of electric charge that make up A New Hope is not the concept of a "A New Hope". Too bad nobody else sees it that way, because when you put that number through a math function named (and patented) h.264, and you draw the outputs of one stream to a pixel grid on a fixed update cycle and you output the other stream as a sine wave of PCM values, you get "A New Hope", the visual and audible experience.


> So I'm allowed to distribute files I own freely, as long as I take the file extension off of it?

Who said you are allowed to distribute them freely? You are not. Same way you aren't allowed making photo copies of books and distributing them freely (except fair use cases). Making personal copies is fine (it's fair use). It's not relevant to the discussion above really.


Right here, in the parent:

> you can own the file, but not the intellectual property it represents. So legally nothing is wrong with buying digital goods (files), while the intellectual property they hold is only licensed to you (and not sold)

He makes references between books the paper and books the print. My point is that while that distinction holds in digital space, nobody actually believes it.


> why would renting cost any different than buying?

So that you can segment the buyers into two: Those who want to see a movie only once and those who want to see it more than once. This way, you can double charge the second segment and use those funds to reduce the price for the first segment. Classic market segmentation.

As long as there are customers of both kind, rentals (even for digital goods) will make sense.


No, it doesn't. My point is there is no need for such segmenting and overcharging those who want to see it more than once (except greed). Because there is no big difference in expenses for the distributor between these two use cases, except for the fact that the second can use the service more. But they already charge the monthly fee.

Anyway, it's not even the case here! Netflix has no plans for purchasing, so there is no segmenting there at all.


"greed"

You mean profit? The reason that businesses exist? That is, the distinction that is literally in the description of for-profit corporations?


Profit and greed are not the same thing. Greed means overcharging for no reason besides wanting to overcharge. I.e. ripping users off for the sake of it. Usually it's possible only when competition is weak. Otherwise customers would just walk away to the competitors. In the case of DRM in video, publishers are a tight conglomerate and there is little disruption there. So they enjoy all kind of sick idiocy they can force on users who buy their stuff.


I don't buy your definition for greed, but even so this case doesn't fit.

Copyright law provides for the difference between a one-time and perpetual license for content. Clearly, viewing content multiple times is more valuable than watching it once, and thus is appropriate for price differentiation.

The fact that the company could take less profit by marking both as the same low price is irrelevant.


> Clearly, viewing content multiple times is more valuable than watching it once, and thus is appropriate for price differentiation.

"Appropriate" is questionable. I already explained above. What is "appropriate" for raising a price? Or what can be called fair pricing? I don't consider raising the price fair, when the merchant has no difference in expenses. It's called a rip off. It is not irrelevant and as I said, it usually happens only when competition is weak. Healthy market tends to prevent such bad behavior, because completion could successfully use the lower price for both cases and all customers would prefer them.


The same arguments you have for 'renting' apply for 'buying' software. Why has software a cost associated at all when the copy (to download) is produced via 0$?

It doesn't make 'sense' too. Maybe in the very long term you are right and software as well as digital goods can be consumed for free (or via paying a special tax)


Lot's of software is sold without DRM just fine. So I don't understand what your point was. I never said about anything about getting all for free. The discussion was about that renting doesn't make sense for digital goods (buying does).


Even more absurd is the story of ebook lending. IIUC libraries fought for it in the consumers' interest with the result that you can sometimes now "take out" an ebook from a library or another reader, blocking their access to it until you "return" it. Worse, publishers implemented "wearing out" of the copy after some number of uses! [http://www.digitaltrends.com/mobile/e-book-library-lending-b...]

I tried to go paper-less last year but gave in when I noticed most books I wanted I can get on Amazon for like: - $15 for a ebook (of limited use due to DRM) - $10 printed in advance on dead trees and shipped to me - $4 for a used paper copy (in near-perfect condition)

How is it possible that a new physical book is cheaper than the ebook!?! The only explanation is that DRM prevented the existance of a second-hand market letting prices sky-rocket.

The key point here is first-sale doctrine. Physical goods could always be resold, and the used books market kept book prices (both sale and rent) in check. Ironically, until the internet peer-to-peer resale was impractical, so second-hand stores came in as "trackers" and libraries as both "trackers" and "seeds" :-)

Anyway, I see this as a counter-point to the replies claiming some customers want DRM because it allows renting which at lower prices than buying. Without DRM, giving up a film you watched to save money wouldn't have to be a justifiable business model for publishers — it'd be an inevitable result of your ability to sell it. ("Selling your copy" also doesn't make any sense in a digital world. But it's no more absurd than the concept of "buying a copy" in the first place, and as long as copyright enables first sale we are better off with second sale freedom.)

I suppose video renting only exists because film studios had to compete with themselves selling physical media. (Scary realization: If Hollywood embraced exclusively digital delivery, they could be more evil!)


Do you really think that studios would license content to Netflix without DRM?

The reason for Netflix to push DRM is simple: you can't offer a streaming service with just House of Cards and a handful of unknown shows.


I understand the situation with studios having crazy demands. My question was equally addressed to their reasoning. And I don't agree in general that Netflix has no way to improve things. Distributors have more influence on publishers than single users.

I already wrote elsewhere about GOG. They work with gaming publishers and convince them that DRM is never needed. And it works. Not always, but with some of them. The more it works, the easier it is for them to demonstrate it to others. But one needs a will to put an effort into it. GOG have DRM-free as their core value. Could Netflix attempt a similar effort? They could. But they don't value DRM-free distribution, so they don't want to bother.


There's a reason why the games on the front page of GOG are Deus Ex and Beyond Good and Evil, and not the latest edition of Call of Duty.

GOG sells old games, which are much past their prime time, and people don't play old games nearly as much as they watch old films and even shows.

Not that Netflix doesn't have influence, of course, but it's still far from being their decision.


No, GOG don't sell just old games only. They changed their strategy a few years ago. They work with publishers on getting new games and successfully (for example Deep Silver). It's a tedious process, but they put an effort into it and it produces results. They gave a few interviews about this in the past. How they have meetings with publishers who ask for graphs, stats and other information in order to decide whether to go with DRM-free or not. It shows that not all of them are lacking common sense. When they are convinced that it only helps their business - things start moving.

With more data to back up their approach GOG have more arguments for these publishers. So the more this grows, the easier it becomes. I wish some distributor would do the same thing for video.

May be gaming is in better shape because there is a higher percentage of good quality indie games than indie films. Independent studios are usually more sensible and don't care about DRM. GOG have that as a base for their statistics. With movies that must be harder, since there aren't that many good quality indie films.

However going back to the "old games" point. If it's easier with old games, what about old films? I don't see any DRM-free distribution for those either.


There are plenty of good indie films - they just aren't desirable in the way indie games are right now. The glut of content is really helping sites like GoG or humble to experiment with different models and push things like no drm. Successful films, and successful indie films, are different.

There is a similar glut of tv content as indie games, so you see many more ways to access this content, but no real push for free-drm here. They are still following the ad-based method.

Netflix/amazon/hulu as they grow their own original content could get to a point where they can disrupt distribution (more than they already have). But all of them already have a culture of drm so it's not clear that they would follow a similar stance as gog given the chance.


> Netflix/amazon/hulu as they grow their own original content could get to a point where they can disrupt distribution (more than they already have). But all of them already have a culture of drm so it's not clear that they would follow a similar stance as gog given the chance.

Yes, I was thinking about that. Netflix sounded apologetic in their W3C discussions, blaming the need for DRM on the publishers. Let them prove that with actions - when we'll see DRM free content that Netflix owns, it would mean that they themselves don't want it. So far I see no indication of any movement in that direction, so their arguments don't sound sincere.


>There is completely no need to prevent users from retaining a copy once they watched it.

For Netflix there's one big reason to: PROFIT


What profit? Netflix offers rentals only, and no sales. And Netflix DRM doesn't prevent any piracy since users who want to illegally retain the copy can do it either way. So what is the reason for them using it? They can simply use sales and have the same profit.


What profit?

The profit that comes from actually having content to offer, which wouldn't happen if they didn't have DRM to "protect" the studios' shows and films.

Regardless of their opinions on DRM, it's not their decision to make, unless they just want to stream self-produced content.


Engaging in proliferating an unethical practice under pretense that "they have no choice" is a very questionable thing. Netflix had a choice, but they chose to do this.


No argument there, I was just replying to your question. You're right that Netflix had the choice of not existing.


Rather the choice of doing something else which doesn't involve unethical practices.


Yes, I'm sure the people would be doing something else. I was just talking about the company, which would have no reason to exist.


They could exist trying to concentrate on DRM-free distribution. Others managed that: https://www.headweb.com/en/

Of course it wouldn't have the same scale. But we aren't talking about scale - you mentioned existence as if selling something DRM-free is not possible or not sustainable.


I don't think the Scandinavian and US markets are comparable, but fair enough, I doubted even something like headweb could exist.


I wish they could expand. But alas, so far nothing like that is coming.


But the right owners also license same movies for sale via other channels, and they (I presume) agree to lower price for Neflix because it's only rentals.


Physical media is a very different market with different mechanisms. In the digital space there are no major offerings with selling files with video so far (besides small local examples like Headweb), so there is no segmenting like mentioned above.


    <audio drm="true">
    <img drm="true">
    <article drm="true">
As soon as you let them put a foot on your house is absurd to believe that the rest will not follow.


>preventing users from saving the content

How can an open source software prevent users from saving the content? If the CDM decrypts to plaintext, it should be trivial to modify the open source sandbox to save the plaintext data. (Obviously the software can prevent saving the content by default).


Some Open Source PDF readers respect the "don't copy" and "don't print" bits, even though you can trivially disable them.


According to Mozilla's official statement[0], it will not be open-source (it will be an open-source wrapper around the closed-source binary)

There is still the question of the analog hole[1], but that's a separate matter (unrelated to open source vs. proprietary binary blob).

[0] https://blog.mozilla.org/blog/2014/05/14/drm-and-the-challen...

[1] https://en.wikipedia.org/wiki/Analog_hole


Nobody really uses the analog hole. It's actually easier to do it digitally, and will remain so, because securing a device against arbitrarily many attackers with physical access and arbitrarily large amounts of time and resources is a practical impossibility. The analog hole is just the formal proof that DRM can never be effective, because if you can see it or hear it you can record it.


Actually Cinavia is an interesting example of trying to close the analog hole. You can point a camcorder at your screen and record a movie, but if you try and play that recording back on a fancy TV or BluRay player, it still won't work because the audio track has encoded instructions in it saying "expect an encrypted/DRMd media stream". If the player sees the content expects to be DRMd, it silences the audio after about 20 minutes.


That's quite interesting! Does it rely on steganography? Because as far as I know, it's quite difficult to keep the integrity of stego contents if the system is public knowledge (e.g. a low pass filter may destroy high frequency watermaking). The sheer amount of degrees of freedom in a minute of 30fps 4k video though makes it seem not so hard to accomplish a steep ( video quality x decoding probability ) tradeoff for attackers.

Of course, then there's the software integrity problem -- I can't imagine a feasible system that prevents bypassing the software verification completely. Or, for hardware checks, I can't see a regulation enforcing "All TVs must have this enabled" (i.e. you just buy from an open brand).

This would be more interesting though for authenticated video streaming. Imagine every user is required to reveal a real identity to retrieve content. Then they can not only watermark the content but point to the exact user responsible, as long as the content has enough degrees of freedom to support it. Makes file sharing a lot harder if you can be held responsible after an indefinite period.


It watermarks into the audio track and is by all accounts incredibly sophisticated and robust. Pirates have been trying to destroy the watermarks for years and all they achieved is making the soundtrack unlistenable.

For bypassing the software verification, it can be made quite hard although it's kind of irrelevant today because it only became mandatory (via BluRay Consortium "regulations") in 2012. So there are still lots of players around that don't do it and this will be the case for the forseeable future. Verance is doing a big push to get it into TVs and other things but I'm not sure how successful they are being. The technology works without a doubt but of course when you add up licensing costs, etc, it's not always necessarily a win.


Wow that's wonderful. I can't wait until the police start playing that track at demonstrations.


I'm curious: Is it currently possible to load a proprietary OS/Browser in VirtualBox and re-direct the graphics/audio stream to a file?


VirtualBox doesn't support HDCP, so if the app requires HDCP it will either refuse to play or maybe it will play in SD resolution.


You got [0] wrong. It is an open source wrapper around a closed source CDM.


Thanks, that's what I meant (and cited). That's what I get for typing quickly on my phone, haha.


It's not even necessary to exploit the analog hole. You can get an HDMI splitter that will strip HDCP, and an HDMI capture card that will let you save full quality, digital video from any protected source.


I interpreted the open-source wrapper to be something that receives the media to be displayed in the browser (but this is just a guess).


DRM is more about having leverage over the provider of the playback device and casual piracy than it is about protecting the content against hardcore piracy.


Which in reality translates to: DRM is about screwing honest users, pirates always find a way around it.


Honest users couldn't care less, as long as it works.


The problem is that in most case it doesn't. Like in the example from this post, where users can no longer run fully open browser. Or when you buy a game and are unable to play it because your internet link is down. I have never seen a DRM system that wouldn't impede honest usage in some way.


Hardcore pirates don't watch this BS, they just get the entire season off Piratebay in 4k with surround sound.


I guess thats pseudo DRM. On the other end you have things like RTMPe, a proprietary highly complex binary protocol that is only implemented in the adobe flash plugin binary blob. Or something like HDCP (the copy protection part of HDMI) that builds a hardware encryption platform, with an central authority and certified hardware vendors.

Those are just 2 examples of "strong" DRM, but since even those two have been so thoroughly broken, we can just assert that any DRM that is based on W3C EME is gonna be childsplay. I don't think anyone actually believes that this W3C crap is gonna be "secure".


The EME standard is explicitly designed to support hardware encryption systems that provide end-to-end encryption - think a proprietary decryption black box in your devices that takes an encrypted, compressed video screen and overlays it directly onto the screen output without it ever touching RAM anywhere where software can access it. Good luck breaking that, short of inconvenient hacks involving HDCP decryption and recompression (and those may not be long for this world either - newer video outputs are AES-encrypted).


I think its always amusing when people say that <latest DRM tech> is unbreakable. When in fact there never was and never will be such a thing.


All the system is rot from the bottom up.. The Honcho's (tm) are putting their dirty hands and corrupting all over .. even the things we take for granted as community driven and serving for a greater good

Dont use Netflix, Dont support DRM, fight for DRM free software..

We took millions of years to make copy and cloning of any information free(as in freedom and in beer) and now some bastards want to turn this into a crime just because they want to profit?

Its just the beggining of something really bad that can corrupt all of the good things we take for granted now, as free education, knowledge sharing and the free flow of information


I understand Mozilla's philosophical objections to the EME, but if the alternative is Flash/Silverlight (and it's pretty clear that is, in fact, the alternative), I don't think Mozilla's mission loses out by implementing the EME.


In practice, so far the EME implementations that content providers have actually been willing to support have been far more tightly locked down than Flash or Silverlight. The Microsoft one supports hardware-level protected playback paths and unlike Silverlight no-one's managed to get it to run under Wine, and the Google one only runs on locked-down official Chromebook hardware which users can't run any non-Google programs on.


The major DRM platform out there is Netflix on Silverlight, and it's not particularly locked-down at all.

Of course there are others, but they hardly matter at all in terms of marketshare.


Netflix won't run on the Mono implementation of Silverlight because it's dependent on a closed source DRM module. That's a bit locked down.


Flash works on the three major desktop/laptop OS', ChromeOS, all the consoles afaik, and Android. EME will probably result in balkanized DRM that will never work on a bunch of those things (or you'll have to worry about whether the content you want to watch supports your platform).

EME is a step down from Flash for consumer choice. A big fat one.


The Flash browser plugin is NOT available on current versions of Android. There is some Flash available for Adobe AIR apps, but that's something different.


Flash DRM has never worked on Linux, AFAIK.


See "Linux" in https://www.adobe.com/products/adobe-access/tech-specs.html .

The problem is that copyright holders can still stipulate policies that exclude Linux. For example, http://voddler.com/en/ greets Linux users with "Here you can rent and play movies. For even more movies and TV-series, visit us from your PC or Mac, where we have a even larger selection."


In theory it does. Unfortunately, I've never been able to get it to work because the way in which it obtains a hardware ID to tie playback to doesn't work on the Linux distro I use and I can't feasibly debug or fix it. Assuming it were actually secure as stated, the Mozilla solution would have the same problem - if you can modify how it obtains the hardware ID, you can bypass the DRM in ways that content providers wouldn't accept.

(The really stupid thing is, I was trying to watch online streaming video that was available to the whole of the UK, with access controlled through IP geolocation. There was no need to tie decryption to a particular device ID in the first place. EME seems to be taking exactly the same approach though with support from Mozilla.)


It definitely does. Proof by troubleshooting: http://helpx.adobe.com/x-productkb/multi/flash-player-11-pro...


No, alternatives are not using DRM at all.


No, Flash absolutely exists and is almost as ubiquitous as web browsers themselves. You don't get to ignore it just because you don't like it.


Leaving DRM to Flash and external plugins is preferable to injecting it into the standard. It makes a clear delineation between broken and improper / insecure tools and proper way forward. I.e. DRM is insecure and unethical by design. Let it stay outside.


Alternative is TPB


>we vary this unique identifier per site (each site is presented a different device identifier) to make it more difficult to track users across sites

What a load of horseshit. They know perfectly well that different identifiers can be tied to the same user with other shared identifiers like advertising tracking identifiers, and yet they pretend they're somehow solving the problem.

Worse, the focus on privacy, while fine, misses the point. Users WANT to be able to download and save content for later consumption. Enabling the prevention of that is not a user friendly act. Sure, content owners have to cope with content sharing and piracy. But maybe that's for the best. Really great content owners like O'Reilly Publishing are providing non-DRMed content today and doing just fine. Create more value than you capture.

Something is rotten at Mozilla. They should be fighting this tooth and nail, but they're going the way of the money. And giving Adobe more credibility in the process... ugh, talk about adding insult to injury. This will mark the demise of Mozilla as a respectable organization.


It's very important that users be able to disable ALL of this functionality with a simple compiler flag. Not just disabling it in the process.

We've seen the failure of "sandboxing" over and over again, and especially with a closed-source, certain-to-be-compromised payload, it's guaranteed that at some point it will be breached.


did you read the blog post? you have to actively consent in installing that plugin to use it. without plugin the sandbox is code without attack surface.


It's unclear to me from the post that the sandbox code will be unbundled from Firefox. Furthermore, it should be possible to distribute a compiled version of Firefox that doesn't have the ability to install the module in the first place, with a minimum of effort.

If you don't enable it by default, but the first time a user visits any website with a video ad they get a clickthrough that downloads and installs it, a huge portion of the user base will end up with it installed. This is less than desirable if you care about security.

I'm sure security- or ideological-focused distros will do a version of this anyway, but it should be supported upstream to segment the code as much as possible so as few vulnerabilities leak into the "main" codebase as possible.


I don't understand your argument. If you are installing firefox for yourself, you don't need a version with the support compiled out; just don't install the plugin.

If you are installing firefox as sysadmin for someone else, you don't need a version with the support compiled out; don't give the users rights to install plugins.

What use case has less security just from the sandbox being enabled?


I saw an interesting comment from gerv @ Mozilla: "Current plan: CDM can scrape memory to check sandbox is a sandbox it trusts." http://lwn.net/Articles/598640/


You know, I've long avoided the Pirate Bay for movies and other copyrighted media, and I pay monthly for month Netflix and Amazon Prime.

However, if Netflix is going to push shit like this and PMP in our faces, then I think I'm going to have to take a look at this Popcorn Time app. Particularly with PMP, it's getting to the point where it's hard for "media-compliant" Linux users to run our open source OS and legally access media at the same time.


I'd be interested to see if any content providers actually make use of this; it seems to be missing certain technical requirements they claimed their partners required during the EME design phase. (In particular, a secure hardware video path and robust node-locking support. This design doesn't appear to actually be able to lock content playback to particular hardware at all if anyone makes even the most trivial attempt to bypass it.)


The history of SDMI vs. iTunes and AACS vs. Windows XP has taught me that DRM "requirements" are just the opening position in a negotiation. Apparently Mozilla doesn't have enough leverage to get rid of DRM completely but they have enough to water it down a bit.


Possibly, but they've already managed to get the W3C and several of the other big browser vendors to agree to meet those requirements, which gives them some pretty strong leverage.


So the open source wrapper can receive unencrypted audio/video frames. Does that mean it does the video decoding too or does it get the compressed stream back?

Either way it doesn't sound like a very strong protection of the content as you can access it with at most a single generation compression loss.

Is it me or are the content providers and the DRM providers realising the limits of DRM and loosening their requirements?


No, it just means they were ignorant enough about the technology to allow Mozilla to do it this way - for now. Also, Mozilla gets to say now that "look, we're implementing DRM, but it's not so bad".

However, once the content owners see how useless this method is (they all are, but this in particular), they will demand heavily proprietary closed source down to the metal software to protect their content. And since Mozilla has "already" kind of agreed to do this, they'll have no choice but to implement that much worse version of DRM.


Wonder what Brendan Eich would have thought of this.


Wonder no more: https://brendaneich.com/2013/10/the-bridge-of-khazad-drm/

He said essentially the same thing; "We are working to get Mozilla and all our users on the right side of this proposed API. We are not just going to say that users cannot have access to streaming Hollywood movies, as that is a good way to lose market share and not have any product with which to uphold our mission."


This is a sad day for the web, but it was honestly one that was inevitable, and one that we all had a hand in making. If you want to know why we have DRM in the web, step 1 is taking a look in the mirror. Mozilla does not represent a majority market share of browser users, and so their voice in the W3C can be over-ruled by the voices of the other stakeholders, among them 3 enormous corporations with substantial media interests.

What follows is harsh, but I believe it to be true. Feel free to tell me that I am wrong, because I fully admit that I could be letting my emotions speak and I could be wrong.

Back in the day the web was ruled by a monopoly and it sucked. Mozilla released firefox but the web only broke free of microsoft's control because people like us did the work to break that control. I started using firefox, and I helped get most of my family members onto it. And many of my tech savvy friends did the same. Slowly but surely Mozilla's market share grew until it reached the point where Microsoft had to react and start to implement web standards, because if they didn't people weren't going to wait for them. They were going to switch to Firefox. And for a brief time we had the promise of a global network for the distribution of information not controlled by a single large corporation, but worked on by a committee which had a large part of its membership come from a public benefit corporation, whose only interest was empowering people to use that network to enhance their lives.

The web exploded, and fearful of being left behind large corporations got into the game with their own browsers. And rather than learn from what happened last time we let a large corporation get majority user share, we, and by "we" I mean you and I and all of the other people who should know better, went right for it.

Google released a cute cartoon describing the inception of chrome, beginning with hiring away people from Mozilla, talking about all of the great things their browser would provide. Microsoft started up development of IE again, and Apple released Safari. A lot of us looked at Firefox and said "Thanks for helping to save the web as we know it, but Chrome is so much more minimal! Safari as a great look and feel! See ya later". Richard Stallman gets a lot of flack around here for his eccentricity when it comes to computing, but goddammit the man can see past his own nose and understands that taking a dump on the only body advocating for you and I in favor of switching to something on such trivial concerns as "look and feel" is a great way to end up right where we are today. Where Mozilla has been marginalized so much by the relentless rush to Chrome that Google can go ahead and implement a DRM scheme on its proprietary OS and then force that through the Web Standards body with the help of Apple and Microsoft. When Mozilla doesn't have enough market share to stop it, because we've all switched over the Chrome based on Octane benchmark scores, and switched over our parents and friends. Where I routinely run into "desktop" sites that are straight up broken in Firefox and fine in Chrome because people can't bother with anything other than webkit prefixes, and where the mobile web is an even bigger disaster of Chrome/Safari specific junk.

So a few years from now, as you continue to bask in the glow google's super minimal interface and safari's incredible smoothness, as Chrome sends your browsing data back to Google and DRM starts to leak into other areas of the web (want to save that image? Sorry! Want to copy this text? Protected! Don't even think about looking at the source) cast a thought to Mozilla, probably still working away to do the best it can for you. Then ask yourself if selling out the web was worth it for the handful of beads you got from all the interests that wanted to close it down and lock it up, and if all the smoothness and look and feel in the world was worth it for the promise of what the web might have been had we not let it slip through our hands.


Why is this even an issue? Sure it's offensive. But it's offensive like someone flipping you off, not like them breaking your leg. I am aware of zero freed-media channels that begin with web content. Music, movies, TV shows; all of the content that isn't available through corporate means is available online from people who don't copy the bits off of their browsers.

This DRM is trying to plug a hole that isn't leaking.


Why not make is a configuration option whether to enable the DRM in Firefox? People who only want to see non-DRM content (much like people running GNU/Linux with "libre" software only) can simply disable the DRM, and the users that are not actually tech savvy won't have to resort to, say, shudders MSIE.


Isn't that what the following portion of the blog post is all about?

"As plugins today, the CDM itself will be distributed by Adobe and will not be included in Firefox. The browser will download the CDM from Adobe and activate it based on user consent."


I think that's what they are doing by requiring consent to add the sandboxed support for Adobe's DRM crap.


I'm wondering this as well - why can it not be implemented (from the browser perspective) as a plugin that is downloaded upon first use?

Isn't this what Iceweasel on Debian will have to do anyway, since Debian cannot ship non-free software in their main repositories?


Yes, it will be a plugin that is downloaded on first use. That's exactly what the blog post describes.


So this DRM is going to use the hardware TPM on cpus I would imagine. This would make it very difficult to break. Well done everyone that supported UEFI!


So - what other good truly open source browser is out there?


Firefox.

Chromium is a mess, Opera is Chromium, WebKit will support this no doubt.


Given that Apple is one of the major DRM vendors, it's a pretty good bet that Safari will support EME. WebKit proper, it's unclear.


Mozilla can't hold the line on DRM. but Mozilla has no trouble holding the line on the Javascript monopoly.


Scuse my ignorance, which JS monopoly? What is Mozilla doing?

I love mdn for my js reference needs, something to do with that?


I believe pekk's talking about not supporting any other client-side languages besides JavaScript (e.g. Dart, PNaCl, etc).


I was under the impression this is true of all browsers, don't all client-side languages like Dart or TypeScript compile to JS before they can be run?


No, Chrome has supported PNaCl natively since version 31. And they already have a fork of Chromium with a native Dart VM.


The writing was on the wall a while ago once Google implemented this into Chrome(Netflix on Chromebooks was the first real world use of this IIRC). Firefox no longer has the market power it once used to have thanks to Chrome being bundled and installed by default with Flash, Acrobat and Java updates etc. Google has been spending massively on pushing Chrome even bundled as default on new machines with OEM agreements to reduce payments to Mozilla in the long term and it's working since the past few years.

Pluginless HTML5 support for H.264 followed a similar path, in which Google promised to remove support from Chrome in favor of WebM(which FF and Opera added support for) but never did, in the meantime Firefox and Opera relied on the promise and then were forced to start implementing support once they realized Google was not going to keep the promise and it was hurting them and then included support(I don't think Opera ever did?).

Three of the four major browsers, Chrome, IE, Safari are owned by huge corporate interests and Mozilla is pretty much powerless since users blame FF if it doesn't support something, so I expect more of such things to happen in the future. It's pretty much game over at this point and I fear this is only the tip of the coming iceberg with all these companies having huge media deals for Play Store, XBox Music/Video and iTunes.


  > in the meantime Firefox and Opera relied on the promise
  > and then were forced to start implementing support once
  > they realized Google was not going to keep the promise
  > and it was hurting them and then included support(I don't
  > think Opera ever did?).
Not only that, Mozilla partnered with CISCO to make h264 usage free for all. Now, people can modify and redistribute Firefox and still retain the ability to play h264. Something that Google gave a shit about when they included h264 in Chrome, but not in Chromium.

If you are using Chrome, don't fool yourself, you are not using an open source browser, but you are helping Google further the agenda of its stakeholders, and they made it clear what their priorties are when they took the first step by implementing this on Chromebooks.


> If you are using Chrome, don't fool yourself, you are not using an open source browser, but you are helping Google further the agenda of its stakeholders

As an example, Chrome won't ship an adblocker by default... but they will add code to prevent popunders from working.

Guess which ad format Google doesn't do...


Actually what happened to that Cisco h264 project?


> Mozilla is pretty much powerless since users blame FF if it doesn't support something

Mozilla is pretty much powerless since users blame FF if it doesn't support something and the bulk of its funding comes from one of those corporate interests (Google).

(Both are problems - even if Mozilla had the market share, if it were still funded (almost) solely by Google, these things would still eventually happen, since the power tends to follow the money in the end.).

I really hope Mozilla manages to become financially independent of Google, whether through donations or some other revenue stream.


> even if Mozilla had the market share, if it were still funded (almost) solely by Google, these things would still eventually happen, since the power tends to follow the money in the end.).

This isn't supported by reality. Feel free to offer any evidence at all, however.

You could just as easily postulate that every privacy enhancement that google adds to their search page is because of influence by Mozilla, which Google is massively dependent on for traffic and therefore revenue, since power tends to follow the money in the end.

Depending on your stat source, at least 1/5 of internet users use Firefox, which means that the percentage of Google users on Firefox is probably that percentage or higher. The Mozilla Corporation is wholly owned by the Mozilla Foundation, but Google has shareholders. So who is more important to whom?


I really hope Mozilla manages to become financially independent of Google, whether through donations or some other revenue stream.

They announced Directory Tiles a while ago, which is a step in that direction.


that plan was canceled.


Unfortunately, there was a fair amount of misreporting over the weekend in response to Johnathan Nightingale's blog post here: https://blog.mozilla.org/futurereleases/2014/05/09/new-tab-e...

The point of the post is that Mozilla is going ahead with experiments like Directory Tiles, but that no money will change hands during testing and development of those experiments. The commitment is that Mozilla will only move forward with seeking revenue if the experiments actually demonstrate added value for users, and that any revenue is collected in a way consistent with the Manifesto.


That is incorrect. See "New Tab Experiments" just for days ago: https://news.ycombinator.com/item?id=7725324


That was a misinterpretation of Jonathan's blog post.


They pulled the plug on this pretty quickly. It's not really clear how they'll transform it in the future, but I think the larger point is still valid. They should not be dependent on a single source of revenue.


> . Firefox no longer has the market power it once used to have thanks to Chrome being bundled and installed by default with Flash, Acrobat and Java updates etc.

Firefox also went through a very long period of being a memory heavy browser with multiple tabs and the UI sharing a single thread of execution for JS execution - meaning that one badly behaving website could render the entire browser unresponsive.

...at least that's why I stopped using it.


I love the person who downvoted this without any response. Am I wrong about the technical challenges Firefox faced?


Opera still doesn't ship H.264 support, except on mobile and some embedded products (TVs, settop boxes, etc.).


In other words: except where they have any market share at all.


A lot of people include Apple when talking about how the big companies are pushing EME, but Safari is now the only browser that hasn't announced support for it. I assume they'll eventually do it, but it's worth noting that Firefox wasn't the last browser to announce support.


Well then, how is Midori doing these days?




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: