Re: Formal objections to Encrypted Media Extensions

> On Sep 7, 2016, at 0:37 , Harry Halpin <hhalpin@w3.org> wrote:
> 
> Paul,
> 
> My change requested is a "substantive change", as it would effect conformance. The change is within charter, but adds more user protection given the controversy. However, has the EME Working Group officially considered this as a possibility? 
> 
> I did not see much official discussion on either github, the mailing list, or the telecon.  
> I do not think that it is unreasonable and would allay (I hope) the large number of concerns that this can be met via this simple technical change that involves *no legal or policy questions be resolved*. I believe this earlier problem was the main reason the EFF covenant and Wendy's objection were overriden. 
> 
> Mark Watson did not seem to think the proposal was unreasonable, but that it was a in principle difference over whether the UA or a user should be able to judge the security of a controversial feature. Given that users have this choice with regards Geolocation and other powerful features and given some of the UAs also have a business model in getting as many people to adopt DRM as possible (thus their work on EME at W3C), I think giving users the choice of opting-in to EME and DRM is common sense. I do strongly believe the web should take the interest of rights of users first. See the Priority of Constituencies document: https://www.w3.org/TR/html-design-principles/#priority-of-constituencies.  It is possible some users won't turn it on, in order to respects their rights we MUST allow them that choice given the level of legal uncertainty and security issues that EME raises. 
> 
> David Singer thought there was not clear evidence that DRM and EME could cause 'user harm’.

No, I repeatedly asked you to substantiate your claim that it would or might. You have so far failed.

> First, it does not appear the Working Group has thought through the possibility that clearKey, despite being ineffective, may be covered by the DMCA (I do not see an open github issue on this rather important matter).

And where is the possibility of user harm in this?

> Second, the security research community believes this feature in browsers can cause 'user harm': https://www.eff.org/deeplinks/2016/06/call-security-community-w3cs-drm-must-be-investigated.

Have you linked the wrong article?  This is Cory’s argument that there is risk to security researchers.  ‘User harm’ does not appear in the article, indeed ‘harm’ does not, and ‘user’ only to refer to billions of them.

> While I respect David's desire to know more about the details of user harm,

Evidence, or a reasonable argument. Not more, which implies you have documented some; any evidence of a possibility of ‘user harm’.

You’re asking the specs to insist something is done in order to mitigate user harm, but have yet to show what harm you’re trying to mitigate, so we have no idea whether the cure matches the problem (if there is a problem).

> the many signatories of this web-page have produced ample work in this regard (as referenced from Wikipedia) and I'm sure some would be happy to discuss in more detail. It does set a precedent that in terms of user security and privacy that this Working Group is overriding the concerns not just of W3C's legal counsel, Wendy Seltzer, but also notable security researchers such as Bruce Schneier and Ron Rivest. 

Now you’re mixing things up again. Please.

> 
> Thus, I would like the Working Group and the Chair to reconsider closing this issue. I'm happy to come to the next telecon to discuss if I am given a spot on the agenda. If not, I hope the Director takes this objection, which does require any legal discussions unlike Wendy or the EFF proposals, but is *purely technical*, into account and rules in its favour. 
> 
>   cheers,
>      harry
> 
> 
> 
> 
> On 09/06/2016 08:26 PM, Paul Cotton wrote:
>> The HME WG has recently received several Formal Objections to EME progressing to Proposed Recommendation.   
>>  
>> These recent formal objections are listed below:
>>  
>> a) ISSUE-288: "EME is not intended to be an interface to technical protection measures"
>> https://github.com/w3c/encrypted-media/issues/288
>> Author: Wendy Seltzer
>>  
>> b) ISSUE-304: Turn off EME by default and activate only with express permission from user
>> https://github.com/w3c/encrypted-media/issues/304
>> Author: Harry Halpin
>>  
>> c) ISSUE-305: Formal objection to Encrypted Media Extensions advancing to Proposed Recommendation
>> https://github.com/w3c/encrypted-media/issues/305
>> Author:  Ruben Rodriguez
>>  
>> Since these formal objections:
>> a)      cannot be satisfied without making “substantive changes” [1] to the EME specification or halting work on the specification entirely, and/or
>> b)     are identical to previous formal objections that the Director has chosen not to sustain, and/or
>> c)      there is no consensus within the HME WG for the required changes especially this late in the EME specification development,
>> in my role as HME WG Chair I am ruling that these issues should be closed with no action for EME V1.
>>  
>> Each of these Formal Objections will be added to the summary page of formal objections [1] and will be presented to the Director when he reviews a request to progress EME to Proposed Recommendation status.
>>  
>> FTR I responded with background earlier on the topic of EME formal objections in:
>> https://lists.w3.org/Archives/Public/public-html-media/2016Aug/0081.html
>> https://lists.w3.org/Archives/Public/public-html-media/2016Aug/0078.html
>>  
>> /paulc
>> HME WG Chair
>>  
>> [1] http://www.w3.org/2015/Process-20150901/#substantive-change
>> [2] https://dev.w3.org/html5/status/formal-objection-status.html
>>  
>> Paul Cotton, Microsoft Canada
>> 17 Eleanor Drive, Ottawa, Ontario K2E 6A3
>> Tel: (425) 705-9596 Fax: (425) 936-7329
>>  
> 
> 

David Singer
Manager, Software Standards, Apple Inc.

Received on Wednesday, 7 September 2016 06:17:52 UTC