Stories
Slash Boxes
Comments

SoylentNews is people

posted by cmn32480 on Friday April 29 2016, @10:03AM   Printer-friendly
from the all-your-videos-are-belong-to-us dept.

The working group that is drafting the W3C's Encrypted Media Extension (EME) specification (aka DRM in HTML5) is baking in language that would allow the DMCA to be invoked despite denials that "EME [is] putting DRM in HTML".

The EME is a set of predefined javascript functions that invoke functions in Content Decryption Modules (CDM) and CDMs are containers for DRM functionality. It's simple and innocuous but how it's worded and what they refuse to define is where the danger lies.

First, the EME is hooked to the DMCA by using very specific legal language: "content protection". One of the people working on the specification freely admits that "it is well-known that the purpose of content protection is not to prevent all unauthorized access to the content (this is impossible)" but despite the fact that it cannot protect the content, the entire working group insists on this very specific language and has refused alternative wording. The reason of course is because "protected content" is the legal term that DRM implementers always use.

Second, the EME is hardware specific by refusing to make a specification for CDMs. By not defining how CDMs are implemented, this leaves it up to each browser author to invent their own. All existing implementations of the CDMs are done using non-portable binary plugins that execute directly on your computer. This means that if a website is using a CDM that isn't ported to your specific browser, OS and architecture, you cannot view the video on that page. So if your computer runs on PowerPC instead of x86 you are out of luck, every site using CDMs will be out of your reach. That's not all, despite having a 4K SmartTV, you can't watch Netflix in 4K because it uses PlayReady 3.0 and it was reveiled last year that PlayReady 3.0 is only for Windows 10 and requires hardware DRM. Specifically it uses an instruction set extension to use a hidden "security processor" which is only in the latest generation of Intel and AMD chips.

All proposed alternatives to the legal language and a legitimate alternative to hardware specific lock-in were rejected by those drafting the EME. After looking into their backgrounds, I found that the group is composed exclusively of Microsoft, Netflix and Google employees.

If you wish to express your concerns, you can still do so on the github issue pages:
Issue #159: Remove all "protection" language
Issue #166: EME specification needs to include a CDM specification


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by tangomargarine on Friday April 29 2016, @02:31PM

    by tangomargarine (667) on Friday April 29 2016, @02:31PM (#338944)

    A) For the purposes of this discussion I'm considering all the marketeers and salespeople who sell The Cloud to not have half a brain.
    B) I don't follow why thinking the joke is funny requires you to not understand The Cloud.

    --
    "Is that really true?" "I just spent the last hour telling you to think for yourself! Didn't you hear anything I said?"
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 2) by fritsd on Friday April 29 2016, @05:12PM

    by fritsd (4586) on Friday April 29 2016, @05:12PM (#339038) Journal

    A) fair enough

    B) I don't follow why thinking the joke is funny requires you to not understand The Cloud.

    well, in my personal case, i haven't had very much dealings with The Cloud yet.
    So, I just hadn't thought about what it all means, when I read the XKCD cartoon and laughed and a little lamp went on above my head. It *IS* somewhere, in someone's basement or datacenter.

    Probably more robust than that, replicated, and with multi-continent failover, etc. etc., but as customer you can't tell if a cloud provider saved on all that expensive stuff by not doing it because "it hardly ever goes wrong anyway".