W3C home > Mailing lists > Public > www-tag@w3.org > October 2013

Re: DRM, EDE, CDM, W3C and the TAG: Is <object classid="[flash]"...> the relevant precedent?

From: Henri Sivonen <hsivonen@hsivonen.fi>
Date: Wed, 23 Oct 2013 13:37:06 +0300
Message-ID: <CANXqsR+YsCSM_o+L=WfEfhv+1cM2vFi-DaCwYRQCV2JxTAxz4A@mail.gmail.com>
To: www-tag <www-tag@w3.org>
On Tue, Oct 22, 2013 at 8:41 PM, Henry S. Thompson <ht@inf.ed.ac.uk> wrote:
> Tim Berners-Lee has posted his views on the DRM-in-HTML5 issue at _On
> Encrypted Video and the Open Web_ [1].

The title is unfortunate. It is technically true that in the DRM case,
video is encrypted. However, it's not the use of encryption that is
the interesting part. The interesting part is on what condition the
keys are obtained.

Talking about "encrypted video" or "encrypted media", while
technically correct, evokes the wrong connotations. This is a very
different kind of "encrypted" compared to the https sort of

>    I think we can safely stipulate that the simple clear key system
>    will not be judged robust enough to satisfy some important content
>    providers.

Right. Clear Key is a toy Key System whose main utility is being able
to show two interoperable independent implementations of the EME
JavaScript API for the purpose of the W3C Process.

> 3) As only obliquely implied by the introductory diagram in that draft
>    [7], completely license-protected web-to-screen pathways require
>    CDM-integration with the platform software _and_ hardware.

Chances are that it's easier to get a license to play a title in HD if
the CDM is hardware-integrated than if the CDM is software-only.

>  I
>    commend Peter Gutmann's _A Cost Analysis of Windows Vista Content
>    Protection_ [8], an analysis of the impact of this requirement on
>    Microsoft Vista and contemporary hardware (chipsets and displays),
>    to those interested in understanding this point and its practical
>    (and architectural) significance in detail.

The Vista Protected Media Path is still in newer versions of Windows.
However, especially on ARM a different architecture has shown up: the
CDM runs under a second kernel and the primary kernel (typically
Linux) doesn't get access to the CPU mode that is meant for code that
is more privileged than the kernel of the operating system that the
user sees. http://www.openvirtualization.org/open-source-arm-trustzone.html

> 4) It seems very unlikely that content providers intending to make use
>    of strong DRM protection for their content will provide opensource
>    implementations of their CDMs.

It's not the content providers' CDMs. The EME CDMs shipped so far are
proprietary to Microsoft and Google--not to Netflix or the studios.
(It's unclear if you used "content providers" to refer to sites that
provide content to users or to the copyright holders of provide
content to the sites.)

> As I understand it, Tim's argument (and that of other W3C staff,
> including CEO Jeff Jaffe) depend essentially on that parallel.  They
> amount to saying "We're just giving you the EME" (|| "we're just
> giving you the object tag"), "if content owners use that functionality
> to deliver (protected) content and users install the necessary CDM (||
> proprietary plugins) to view it, that's a matter between consenting
> adults and part of the Open Web".

I think it's wrong to portray things that involve either proprietary
CDMs or proprietary NPAPI/ActiveX plug-ins as being part of the "Open

When the term "Open Web" showed up, it was typically used as a
shorthand for "not Flash". However, it's not the lack of Flash
specifically that was the crux of the matter but the exclusive use of
non-proprietary features that are independently interoperable
implemented in browser engines themselves.

I think it's wrong to commandeer the term "Open Web" to mean "uses
some W3C stuff" when it originally meant "doesn't include the
proprietary stuff". That is, the involvement of Microsoft-proprietary,
Google-proprietary or Foobar-proprietary CDM should disqualify
something from being part of the Open Web. The use of the
to-be-W3C-blessed API to communicate with the proprietary component
should not be enough to qualify something as being part of the Open
Web--neither should "uses a smaller proprietary box than before".

> This parallel does beg the question as to whether the difference
> between the freely-available Adobe and Apple plugins for use with the
> <object> tag,

I think the mention of Apple plug-ins is beside the point, since the
QuickTime plug-in wasn't used for DRM purposes. On the other hand, I
think Silverlight should be mentioned, because EME CDMs are first and
foremost replacements for the PlayReady component that's inside the
Silverlight plug-in. (EME CDMs can also serve as a replacement for the
Adobe Access component that's inside Flash Player, but that secondary
considering that the architecture of EME is informed by
Silverlight/PlayReady rather than Flash/Access and Silverlight is what
Netflix, the content side proposer of EME, is migrating from.)

> and the presumably restricted-to-customers CDM plugins

Whose customers do you mean? The CDMs shipped so far have been bundled
with operating systems.

> which will be necessary for use with EME changes the overall picture
> in important ways.

The difference in licensing and distribution of CDMs compared to NPAPI
plug-ins indeed makes the overall picture different.

Henri Sivonen
Received on Wednesday, 23 October 2013 10:37:34 UTC

This archive was generated by hypermail 2.3.1 : Wednesday, 7 January 2015 15:33:22 UTC