Subject: W3C standards and the Hollyweb

From: Alessandro Vesely <[email-masked]>
Date: Thu, 25 Apr 2013 11:38:02 +0200

The Encrypted Media Extensions (EME, a.k.a. DRM in HTML5)
specification is not a real DRM itself.  It provides for add-on parts
described as Content Decryption Modules that provide DRM functionality
for one or more Key Systems.  DRMs are obviously designed to be
non-interoperable, and EME is a standard for managing such
non-standard stuff.  That is going to break interoperability, as any
given browser will inevitably miss some decryption modules.

Internet, globalization, and the information age may well entail a
change in the basic principles of economics.  However, IMHO, DRM is
not a solution to copyright infringement, not more than postage is a
solution to spam.  Injecting DRM through EME is a disservice to web
standardization, since the latter is supposed to foster the Internet
revolution.

If you haven't done so already, please sign the FSF petition:
http://www.defectivebydesign.org/no-drm-in-html5

Thank you

---

From: Mark Nottingham <[email-masked]>
Date: Fri, 26 Apr 2013 10:53:58 +1000

Personally, I don't have a firm position on these issues, but I couldn't let this pass by.

> given browser will inevitably miss some decryption modules.

The same could be said about the Content-Type header in HTTP; allowing for new, even non-standard formats in browsers is by design, not counter to the Web (or Internet) architecture. "All implementations moving in lockstep" is not the same as "interoperability," and we have plenty of examples of such extension points in our protocols here.

[...]

> Injecting DRM through EME is a disservice to web

What does that *mean*? I'm wary of waving around banners like "the Internet revolution", since they can so easily be misused.

If folks want to argue against DRM, or even accommodating DRM in standards, that's great, but let's not use bad arguments to do it.

Regards,

--
Mark Nottingham   http://www.mnot.net/

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 26 Apr 2013 13:38:34 +0200

On Fri 26/Apr/2013 02:53:58 +0200 Mark Nottingham wrote:
>> DRMs are obviously designed to be non-interoperable, and EME is a
>> standard for managing such non-standard stuff.  That is going to
>> break interoperability, as any given browser will inevitably miss
>> some decryption modules.
> 
> The same could be said about the Content-Type header in HTTP;
> allowing for new, even non-standard formats in browsers is by
> design, not counter to the Web (or Internet) architecture.

Correct, and Content-Type is in mail too.  In that case,
standardization is encouraged for each type and subtype.

> "All implementations moving in lockstep" is not the same as
> "interoperability," and we have plenty of examples of such
> extension points in our protocols here.

Yes.

>> Injecting DRM through EME is a disservice to web standardization,
>> since the latter is supposed to foster the Internet revolution.
> 
> What does that *mean*? I'm wary of waving around banners like "the
> Internet revolution", since they can so easily be misused.

The Internet revolution is the big step after the industrial
revolution.  I didn't mean to misuse that banner:  It is a typical
effect of industrial revolution to bring many workers to some large
factories.  Free-software development, for a counter example, doesn't
fit into that model.  I'd agree that the phenomenon is still young and
that the economics of the new model definitely need to be improved.
However, that cannot be done while sticking to the old production
model.  Which direction is the media industry heading to?

Watch-on-demand could have been implemented on private networks and
proprietary equipment.  However, cables had not been laid until the
Internet took root, and that was pushed by the web.  The direction of
history seems to be clear enough to allow taking a firm position.

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 27 Apr 2013 07:59:52 +1200

>> Personally, I don't have a firm position on these issues, but I couldn't let this pass by.

I've thought about this a bit and looked at some on-line discussions.

In as far as this might be an IETF->W3C liaison issue (and it probably should be),
I would suggest that three points could be made:

1. DRM is a fact of life, and it is therefore better that there should
be a well-formulated standard than a free-for-all. A free-for-all is a
guaranteed route to non-interoperability.

2. DRM should be off by default. That's probably a given (if a content
provider doesn't use EME there will be no DRM) but it needs to be specified.

3. EME should have a very low or zero cost of entry for a content provider.
Quoting from a commenter on The Register:
"The DRM mechanism must allow *individuals* (or small groups) a
low-cost low-hassle way to use it. That's because the way to destroy
the various evil DRM empires is not to steal content - it's to allow
creators to manage the sale of their own creations without needing a
big bad bloodsucker to "help" them. That means a DRM system that anybody
can use to protect their own stuff."

    Brian

---

From: Tim Bray <[email-masked]>
Date: Fri, 26 Apr 2013 13:55:19 -0700

> guaranteed route to non-interoperability.

Crack cocaine, prostitution, and political corruption are also facts of
life.

OK, pardon the cheap shot, but I don’t think SDOs that have some sort of
stewardship relationship to the Internet should ever play any part
whatsoever in the facilitation of DRM.

I won’t consume your input bandwidth by backing up this position; the
arguments pro and contra DRM are not exactly secret, and I haven’t heard
any new ones in some years.  -T

---

From: Josh Howlett <[email-masked]>
Date: Fri, 26 Apr 2013 21:23:48 +0000

>
>OK, pardon the cheap shot, but I don¹t think SDOs that have some sort of

So it's ok to define protocols that manage access to services (e.g., TLS,
GSS, SASL, etc), but not to the content that might be delivered by those
same services? Barring the technicalities around around how authorisation
is enforced, I don't see a distinction.

Josh.

Janet(UK) is a trading name of Jisc Collections and Janet Limited, a 
not-for-profit company which is registered in England under No. 2881024 
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 26 Apr 2013 22:39:15 +0100

> is enforced, I don't see a distinction.

Some technicalities count: DRM schemes are always easily broken
by anyone who cares. Personally, I think that's a good reason
to discourage work on them.

S.

---

From: [email-masked] (Martin Rex)
Date: Fri, 26 Apr 2013 23:53:54 +0200 (CEST)

> 3. EME should have a very low or zero cost of entry for a content provider.

DRM system are evil in any way you look at it.

Originally, copyright was a conceived as a temporary (50yrs) monopoly.
The protection period has in recent years been prolonged in many years
to at least 70 years.

When you add DRM into the picture, the monopoly will effectively
*FOREVER*, because there is unlikely going to be someone around
to remove the DRM protection after that time has passed, and
it may also easily happen that the data format is not supported
that long -- and converting the data to a newer format is what
DRM is made to prevent among lots of other things...

-Martin

---

From: SM <[email-masked]>
Date: Fri, 26 Apr 2013 16:03:45 -0700

>given browser will inevitably miss some decryption modules.

I read 
https://dvcs.w3.org/hg/html-media/raw-file/tip/encrypted-media/encrypted-media.html 
 From what I understand "Digital Rights Management technologies 
attempts to control what I can and can't do with the media and 
hardware I have purchased".  I did some reading [1] and I found that:

   "An open DRM interoperability standard accelerates content consumption in
    the home network and propels device volume growth and thus benefits the
    consumers, the content owners and the device manufacturers"

I found that hard to believe.  There is a paper about "a weakness in 
the High Bandwidth Digital Content Protection (HDCP) scheme which may 
lead to practical attacks" [2].  Someone found a way put the theory 
into practice.

There was a paper about "The Darknet and the Future of Content 
Distribution" [3].  Quoting the Introduction:

   "People have always copied things. In the past, most items of value were
    physical objects. Patent law and economies of scale meant that small scale
    copying of physical objects was usually uneconomic, and large-scale copying
    (if it infringed) was stoppable using policemen and courts."

I suggest reading the paper.

Regards,
-sm

1. http://www.ietf.org/proceedings/60/slides/perm-4.pdf
2. 
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.70.184&rep=rep1&type=pdf
3. http://crypto.stanford.edu/DRM2002/darknet5.doc

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Sat, 27 Apr 2013 03:01:23 +0200

>http://www.defectivebydesign.org/no-drm-in-html5

The W3C is asking for comments on its "Encrypted Media Extensions" pro-
posal, including on whether W3C should continue work on the document, to
be sent to the publically archived [email-masked] mailing list
(see the "Status of This Document" section of the proposal).

A few days before I attended my first W3C meeting, hundreds of people
answered a similar call for comments via e-mail. Tim Bray, Alan Cox,
Theo de Raadt, Aaron Swartz, Richard Stallman, Tim O'Reilly, Jeffrey
Zeldman, Eric S. Raymond, Tim Berners-Lee and many others shared their
thoughts on the Patent Policy the W3C was proposing back then on W3C's
list, <http://lists.w3.org/Archives/Public/www-patentpolicy-comment/>.

In contrast, <http://lists.w3.org/Archives/Public/public-html-media/>
has almost no relevant comments. If people have nothing to say, they
will not be heard.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Mark Nottingham <[email-masked]>
Date: Sat, 27 Apr 2013 16:40:03 +1000

> history seems to be clear enough to allow taking a firm position.

Well said.

---

From: Alessandro Vesely <[email-masked]>
Date: Sat, 27 Apr 2013 10:02:31 +0200

>   can use to protect their own stuff."

A DRM add-on that individuals or small groups use to protect their
stuff seems to be a chimera.  Manu Sporny [1] points out that even
Microsoft is unable to support Silverlight on Internet Explorer 8 on
older versions of their operating system and the latest version of
Chrome on certain versions of Windows and Mac.  Can small groups be
expected to do better?

A comparison with youtube suggests that yet another software barrier
is not what small media producers really need.

[1] http://manu.sporny.org/2013/drm-in-html5/

---

From: Brian E Carpenter <[email-masked]>
Date: Sun, 28 Apr 2013 07:53:22 +1200

On 27/04/2013 20:02, Alessandro Vesely wrote:

> stuff seems to be a chimera.  

Has anybody tried to design one?

   Brian

---

From: [email-masked] (Dale R. Worley)
Date: Mon, 29 Apr 2013 18:00:32 -0400 (EDT)

> From: [email-masked] (Martin Rex)
> 

I read an analysis somewhere that pointed out that DRM is evil in
considerably different ways than one naively thinks.  You tend to
think of DRM as a way of enforcing copyright.  But the real power of
DRM is in effectively eliminating the "right of first sale".

Currently, once you've bought a copy of a copyrighted work, you have
bought a physical object, the "copy", and that ownership gives you a
bundle containing a considerable number of rights, including the right
to sell the copy to someone else.

The real economic purpose of DRM is to be able to subdivide the bundle
of rights traditionally associated with the "copy" so that they can be
sold and priced individually.  Even better, since the "copy" may no
longer be transferrable between customers, different customers can be
charged different prices for the same thing.

The net effect is that the work creators can get larger aggregate
sales for the creation than before.  Which may or may not be a good
thing.  Wikipedia has a long article, "Price discrimination", on this.

Dale