Response from Director to formal objection "Turn off EME by default and activate only with express permission from user"

Everyone,

Perhaps Tim Berners-Lee (the Director) overrode my objection, but I haven't
been updated and see no evidence. Also, as is often, if Tim Berners-Lee did
not actually attend the transition call for Encrypted Media Extensions but
either PLH or Ralph Swick acted as Director, I would like to know and
demand an explicit response to my formal objection, which was viewed as
in-scope by both the editors and the chair of the HME WG.

Barring a decision I agree with from, I'm going to re-file my formal
objection. Note that recently there has been moves to make EME (and thus,
DRM) not only on-by-default, but mandatory - and hard, if not impossible,
at least to disable by users [1]. This is a blatant violation of the rights
of the user to control what software is on their device, and I'm surprised
this feature was not agreed on by HME WG.

Furthermore, it is blatantly hypocritical of the W3C to not address this
concern in the Proposed Recommendation, as user control has been enforced
in other specifications such as WebRTC where there are similar concerns for
user fatigue. Indeed, I am stating that a user MUST be informed at least
once and explicitly agree *before* an EME and, if not already pre-installed
in the OS, the black box of CDM is sent to their device.

The arguments from W3C PR and the HME WG that a 'sandbox' is somehow a
magical solution to user concerns over security and privacy with DRM is
equally incorrect. Browsers, including in particular sandboxes, routinely
have vulnerabilities [2]. There is plenty of evidence that no sandbox is
secure, including those put around CDMs. For an evidence, see the recent
pwn2own results, and we should expect more hacks soon particularly on the
kinds of DRM enabled by EME.

     cheers,
        harry

[1] http://boingboing.net/2017/01/30/google-quietly-makes-optiona.html
[2]
https://venturebeat.com/2016/03/18/pwn2own-2016-chrome-edge-and-safari-hacked-460k-awarded-in-total/