The UXP and DRM dilemma

[Moonchild]

As many of you know, we currently have outdated Widevine support in UXP. We've internally discussed this many times and it doesn't look like there will be a way forward for this technology because of the following market factors:

• Google is the sole provider of in-browser DRM content decryption modules and DRM service employed by it. There is no indication anywhere that this will change in the years to come.
• Google has clearly indicated to not want to support alternative Open Source initiatives (outside of the direct Chrome/Firefox sphere of influence) wanting to employ Widevine. See also Metastream.
• We likewise have no licensing to use the CDM and Google has been unresponsive to requests for licensing (see also previous point, with the difference they didn't even respond to my attempts to get an answer), meaning we are legally not allowed to include use of the CDM even if dynamically retrieved.
• The encryption and decryption is a tightly-controlled secret - even just admitting you have been looking at how it works will make you subject to legal prosecution. This means that there is no hope for any alternative implementations that can read and decode EME-encrypted content.
• So far, Google's implementation has been kept abreast of our support level multiple times. APIs have been updated whenever we successfully implemented support for them, and there is every indication that this will be done yet again if we implement the next API level. Part of not working on this API support for a long while (aside from our media component owner being largely unavailable) was to test if this was indeed deliberate, and the instant halt of development on/changes to the API when we stopped making an effort has been noted as being more than coincidental. If this is a deliberate strategy, then we will simply never have any hope of having lasting support.
• Since Google controls the CDM, the distribution platform and the licensing, its proprietary nature and use allowance will likely keep this forever out of reach for UXP.

Because of all this, we're leaning towards completely removing EME and DRM support from the platform, (greatly) simplifying media delivery code -- but I'd like to toss this out into open discussion first to see if there are any reasons to keep it we may have overlooked/are not aware of.

[moonbat]

Since DRM is part of platform code and not browser specific, the only other case it might be needed would be for standalone UXP applications that need to use DRM and I don't know if there are any being actively developed. It's a shame to drop it because the only reason I use other browsers is DRM for Netflix/Amazon Prime.

[Moonchild]

the only other case it might be needed would be for standalone UXP applications that need to use DRM

Well the problem is that those applications will also run into the very same licensing issues with Google. Unless you really think that Google will treat those any different than Pale Moon (which I sincerely doubt considering they refused Metastream).

[Bilbo47]

Google is specifically trying to kill all non-google browsing. They want to keep DRM away from everyone other than themselves - fine, we don't need it. I don't want any ggl code being run during my general browsing, which ought to be private by default. The only time I allow DRM is by using a browser that has it, and that browser gets used only for this purpose - using services that deliver only through DRM.

[Moonchild]

The point behind making this topic is to probe for anything that should be considered as a reason not to go forward with removal. There are plenty of reasons why it would be a good idea but since this is a platform decision it will affect all current and future applications, it needs due consideration. Votes "in favor" need not be posted, we are all aware of the restrictive nature of DRM, I'm sure.

[ron_1]

Off-topic:

• Google is the sole provider of in-browser DRM content decryption modules and DRM service employed by it. There is no indication anywhere that this will change in the years to come.
• Google has clearly indicated to not want to support alternative Open Source initiatives (outside of the direct Chrome/Firefox sphere of influence) wanting to employ Widevine. See also Metastream.

Has these two points been mentioned in the anti-trust action against Gooble? Seems to me these two things alone are reason enough to break up Gooble.

EDIT
I noticed it says at the top of this board: Please keep everything here strictly on-topic.
So I came back to delete this post, but there's no delete button (the "X") now.

[Moonchild]

Off-topic:

I noticed it says at the top of this board: Please keep everything here strictly on-topic.

That is primarily about topic relevance to the board, not necessarily about post relevance to the topic.

Has these two points been mentioned in the anti-trust action against Gooble?

Absolutely. At least I made sure to touch on this in my panel interview.

[Tharthan]

[*]We likewise have no licensing to use the CDM and Google has been unresponsive to requests for licensing (see also previous point, with the difference they didn't even respond to my attempts to get an answer), meaning we are legally not allowed to include use of the CDM even if dynamically retrieved.

For that particular reason, I respect your decision to remove support for Widevine DRM.

I really would have liked to be able to access any site with a UXP browser that would be useful to use. That way, a full browsing experience on the latter-day Web would be possible with UXP browsers.

However, I suppose that I will just have to do without any services that use DRM. I would much rather do without than use some Chrome variant or anything like that. I used to use Amazon Prime's Wii U application, but that was discontinued quite a while ago.

[BenFenner]

Not knowing enough about the topic, what would a naïve end user not be able to do in the future that they can do now with Pale Moon?

I'm reading in this thread a lot about UXP, but then a lot about Netflix/Amazon prime and I don't see how the two are related.

Removing the discussed DRM capability would do what? Stop Netflix streaming and similar services from working? Maybe YouTube in the future if/when Google starts using this DRM for that (or are they already)?

I haven't had Netflix streaming working reliably in Pale Moon for a loooong time. So for that I load up Firefox, and for that only. Are we talking about things like that?

It is hard for me to think of a reason to keep it when I don't know exactly what it is we're considering ditching. Sorry.
If I could get a little more explanation, that would be helpful. Links or "search XYZ you fool" are fine too.

[vannilla]

Not knowing enough about the topic, what would a naïve end user not be able to do in the future that they can do now with Pale Moon?

Right now all it does is enable the browser to use media streaming services, i.e. Netflix, Amazon Prime et al. YouTube also does use that too, in some places.
Removing it will mean that UXP-based applications (not just web browsers) will be unable to use those services.
If DRM will creep enough into the rest of the web, it will be used for something else too, with great probability. In that case, UXP-based applications will be unable to also use those features.

[Moonchild]

No, sorry but you are incorrect.

As regards Pale Moon there will be no difference at all because it is not built with EME/DRM support (by design!).
But as stated this is different for other applications (e.g. Basilisk) that build on the platform that do have EME enabled.

[BenFenner]

Ahhh, that explains it. Thank you.

I have no dog in this fight, so I'll bow out until I do.

[New Tobin Paradigm]

I had considered doing DRM in Borealis but decided against it. Obviously, a Mail Client doesn't need it. IF by several layers of hell freezing over happened the fall out for Pale Moon is that Pale Moon couldn't get DRM in the future but that was less likely than me running OpenBSD. Still, I feel like the internet is gonna get worse with all mainstream video going DRM eventually regardless of what it is. We will simply miss out on any content without a fallback but that would be the situation anyway with Pale Moon.

Also, Google Widevine does not support SunOS at all so that as a UXP target would be boned anyway as would likely arm linux, or sparc anything.. Etc.

[Moonbird]

Idea: There is room for some funny message to indicate, that something DRM-related isn't loading in Pale Moon for a good reason. Like "DRM warning, this website tries to fool you!". And next to that the picture of a silly looking fish. Or wolf.

I'd like to see Pale Moon keeping its head upright and not following everything the big companies do.

[Moonchild]

Like "DRM warning, this website tries to fool you!"

I don't think that's a good idea. That's a slippery slope even if meant funny.

[moonbat]

That's a slippery slope even if meant funny.

It starts with one or two things like that, and then goes full blown irritating with cutesy messages everywhere (seen post Australis) or even privacy violating (hello about:robots!). The time when the web was the domain of irreverent hackers is long gone, such a move would've been fun maybe 15 years ago but not anymore.

[New Tobin Paradigm]

Off-topic:

[micwoj92]

Off-topic:

Off-topic:
Untitled.png

I feel like Pale Moon is not longer my favourite browser...

[vannilla]

Off-topic:
I feel like Pale Moon is not longer my favourite browser...

Off-topic:
Good thing that's Borealis then

[athenian200]

Hmm... as much as I'm not a fan of Widevine and will never benefit from it anyway, I will take a stab at coming up with reasons to keep it just to make sure everything is considered.

1. It would make Basilisk less relevant on platforms that it supports. One of the main reasons people are drawn to it is the fact that it technically supports DRM while the other UXP-based browsers don't. Without DRM, Basilisk offers a lot less value versus other UXP-based browser applications.

2. Other alternative browsers like the Chromium forks and Waterfox still seem to allow enabling DRM in various ways despite not having it by default, and creating a perception that UXP can't offer that capability and will never be able to could really hurt us in comparisons.

3. This form of DRM is likely to only become more widely used in the future with both Flash and Silverlight being deprecated. The alternative plug-in based approaches have largely dried up, so this effectively means the platform won't support protected content of any kind unless the service provider is willing to create a custom plugin for UXP that gets around the problem.

4. Making a decision like this arguably signals that we are officially scaling back our ambitions, and now fully expect our offering to be used alongside a standard installation of Chrome or Firefox out of necessity. While that may be the reality on the ground for most users at the moment, conceding that this will always be the case could demoralize users who were patiently hoping for progress on that front.

5. From an application platform perspective, UXP as a platform competes with Electron in some ways. Removing even the potential of DRM makes UXP a far less attractive investment than Electron for anyone building a new application, and may ensure that it will only be used to revive older applications that already exist in some form, along the lines of Songbird/Nightingale or KompoZer.

Those are the five main reasons I can imagine for keeping it, and I would be very surprised to hear an argument for retaining it that didn't come at the issue from one of those five perspectives.