Widevine retiring its Cloud License Service (CLS)(castlabs.com)
castlabs.com
Widevine retiring its Cloud License Service (CLS)
https://castlabs.com/blog/widevine-retiring-cloud-license-service/
47 comments
> And surprise surprise, the blog post in question appears to be very thinly disguised marketing for one of those third parties.
To be fair, there is no official Google announcement to link to. They seem to have announced this very quietly and it is easy for someone to go to the Widevine docs and build something around the server without realizing it’s going away.
To be fair, there is no official Google announcement to link to. They seem to have announced this very quietly and it is easy for someone to go to the Widevine docs and build something around the server without realizing it’s going away.
I think that is right technically, but there is still real migration pain here for teams that quietly depended on the free hosted path. The annoying part is usually not swapping providers. It is finding every place license issuance, renewal, and failure handling got baked into the stack and validating it before the old service disappears.
Modern DRM for video and audio is such a strange construct.
It never stopped a thing. Clearly, it only exists to cover someone's arses and check some boxes off the requirement lists.
And yet, some people put actual effort into integrating it, and keep shipping mandatory DRM modules that run with deranged levels of privilege in places like TrustZone. They keep restricting some browsers and phones from being able to view Full HD content - despite that Full HD footage being on every shady pirate streaming website that runs on ads for online slot machines and penis enlargement pills, and the 4K versions of that very same content being available day 1 in any torrent search engine. Because some cheeky madman somewhere has a few exploits, and one exploit is all it takes for DRM to stay broken forever.
Punish the legitimate users, and completely fail to deter the pirates. Security theater at its finest.
Every time I read of how modern economics eliminate waste and inefficiency, this kind of DRM stands out as a counterexample. It never worked and never will - nonetheless, here it is.
Some people keep writing and signing the licensing deals with those stupid requirements that don't touch reality in them. Other people keep needing to fulfill them. And so, the strange useless cover-your-arse-ware lingers in every device, like the smell of stale piss in a public toilet. With no care for how unwelcome it is.
It never stopped a thing. Clearly, it only exists to cover someone's arses and check some boxes off the requirement lists.
And yet, some people put actual effort into integrating it, and keep shipping mandatory DRM modules that run with deranged levels of privilege in places like TrustZone. They keep restricting some browsers and phones from being able to view Full HD content - despite that Full HD footage being on every shady pirate streaming website that runs on ads for online slot machines and penis enlargement pills, and the 4K versions of that very same content being available day 1 in any torrent search engine. Because some cheeky madman somewhere has a few exploits, and one exploit is all it takes for DRM to stay broken forever.
Punish the legitimate users, and completely fail to deter the pirates. Security theater at its finest.
Every time I read of how modern economics eliminate waste and inefficiency, this kind of DRM stands out as a counterexample. It never worked and never will - nonetheless, here it is.
Some people keep writing and signing the licensing deals with those stupid requirements that don't touch reality in them. Other people keep needing to fulfill them. And so, the strange useless cover-your-arse-ware lingers in every device, like the smell of stale piss in a public toilet. With no care for how unwelcome it is.
>it never stopped a thing
Funnily enough it works better as a deterrent against releasing an Android device without Google being involved than protecting media.
Funnily enough it works better as a deterrent against releasing an Android device without Google being involved than protecting media.
That is exactly what the purpose of DRM is. Its not to prevent piracy, its to create a barrier to entry.
The tech people have done a terrible job of using their leverage.
They're inventing the cool hardware and infrastructure, but for some reason, they let the content people dictate terms. I want to see the LGs and Samsungs of the world announching "we're making this amazing 16k OLED panel, and the only interface it has is unencrypted DisplayPort. If you don't want to your precious movies on it, there are still stock traders who will buy it to fill with graphs or programmers who will fill it with StackOverflow tabs and vim windows."
Sure, Sony could try to make some sort of sealed box viewing system that never let the raw bitstream out-- by the darkness, they've spent the last 30 years trying-- but most of the content firms don't have the technical chops or the market power to make it happen. I can fully imagine them trying to sell multiple different set-top boxes, each of which is only capable of decoding one studio's DRM.
On the other hand, what ended up liberating the music market wasn't some grand audiophile product, it was the market full of $29 no-brand/minor-brand "MP3 players". It was such a fragmented market, running random bare-metal firmware on the cheapest MCUs available, that nobody except Apple could possibly make a play out of selling anything but DRM-free content.
They're inventing the cool hardware and infrastructure, but for some reason, they let the content people dictate terms. I want to see the LGs and Samsungs of the world announching "we're making this amazing 16k OLED panel, and the only interface it has is unencrypted DisplayPort. If you don't want to your precious movies on it, there are still stock traders who will buy it to fill with graphs or programmers who will fill it with StackOverflow tabs and vim windows."
Sure, Sony could try to make some sort of sealed box viewing system that never let the raw bitstream out-- by the darkness, they've spent the last 30 years trying-- but most of the content firms don't have the technical chops or the market power to make it happen. I can fully imagine them trying to sell multiple different set-top boxes, each of which is only capable of decoding one studio's DRM.
On the other hand, what ended up liberating the music market wasn't some grand audiophile product, it was the market full of $29 no-brand/minor-brand "MP3 players". It was such a fragmented market, running random bare-metal firmware on the cheapest MCUs available, that nobody except Apple could possibly make a play out of selling anything but DRM-free content.
>and keep shipping mandatory DRM modules that run with deranged levels of privilege in places like TrustZone
What's "deranged" about TrustZone? It's just a way to allow code to be executed in a tamper-proof way. Advocates like Stallman might object to this on the basis of "freedom to tinker" and "user control", but it can't steal your data, which is what "deranged levels of privilege" sounds like.
Moreover it's not too hard to imagine DRM implemented in a way that doesn't have those issues. The most obvious example would be some sort of dongle that handles decryption and forwards it to a TV. In other words, a chromecast. It'll still be a black box, but I doubt anyone seriously cares. You can make a case about how your computer or smartphone should be "open", but the case is far less persuasive for a media dongle.
What's "deranged" about TrustZone? It's just a way to allow code to be executed in a tamper-proof way. Advocates like Stallman might object to this on the basis of "freedom to tinker" and "user control", but it can't steal your data, which is what "deranged levels of privilege" sounds like.
Moreover it's not too hard to imagine DRM implemented in a way that doesn't have those issues. The most obvious example would be some sort of dongle that handles decryption and forwards it to a TV. In other words, a chromecast. It'll still be a black box, but I doubt anyone seriously cares. You can make a case about how your computer or smartphone should be "open", but the case is far less persuasive for a media dongle.
In ARM, TrustZone[0] is a higher level of privilege than hypervisors (EL3 vs. EL2); it's morally equivalent to x86 System Management Mode. That means it categorically can steal your data. There's nothing EL2 code can do to prevent inspection or manipulation from a malicious EL3.
A less awful design would have been to keep the security code at EL2 and have CPU hardware that can isolate two EL2s from one another[1]. This is ultimately what ARM wound up doing with S-EL2, but you still need to have EL3 code to define the boundary between the two. At best the SoC vendor can design a (readable/auditable!) boot ROM that occupies EL3 and enforces a boundary between secure and non-secure EL2s.
[0] Or, at least, TrustZone's secure monitor. TZ can of course run secure code at lower privilege levels, but that doesn't stop a TZ compromise from becoming a full system compromise.
[1] If you're wondering, this is morally equivalent to Apple's guarded exception levels.
A less awful design would have been to keep the security code at EL2 and have CPU hardware that can isolate two EL2s from one another[1]. This is ultimately what ARM wound up doing with S-EL2, but you still need to have EL3 code to define the boundary between the two. At best the SoC vendor can design a (readable/auditable!) boot ROM that occupies EL3 and enforces a boundary between secure and non-secure EL2s.
[0] Or, at least, TrustZone's secure monitor. TZ can of course run secure code at lower privilege levels, but that doesn't stop a TZ compromise from becoming a full system compromise.
[1] If you're wondering, this is morally equivalent to Apple's guarded exception levels.
A big part of the responsibility lays on software and hardware companies like Google or Apple that implement (or allow) support for these DRMs.
They could perfectly refuse them, and de-facto DRMs would be marginalized, to a point it would not even be an option.
They could perfectly refuse them, and de-facto DRMs would be marginalized, to a point it would not even be an option.
Oh, definitely. They could put the foot down and end this pointless charade swiftly. But if Google and Apple had the balls to go against the big media, the world would look very differently.
They are, in fact, the big media themselves now. They have the power, and more than enough of it. No streaming service can afford to skip having an app on iOS or Android - all Apple has to do is crack the whip. Say "this DRM is no longer compliant with our device policy and will be phased out by 2030" and there goes that.
But they still act like they're weird web teens who can't raise a voice against the big media boys without getting bullied for it.
That, or they believe this DRM charade serves them - and user experience can go suck a dick.
They are, in fact, the big media themselves now. They have the power, and more than enough of it. No streaming service can afford to skip having an app on iOS or Android - all Apple has to do is crack the whip. Say "this DRM is no longer compliant with our device policy and will be phased out by 2030" and there goes that.
But they still act like they're weird web teens who can't raise a voice against the big media boys without getting bullied for it.
That, or they believe this DRM charade serves them - and user experience can go suck a dick.
> That, or they believe this DRM charade serves them - and user experience can go suck a dick.
I'd go for this option, the duopoly think it could be an extra barrier which can help them to prevent future competition.
I'd go for this option, the duopoly think it could be an extra barrier which can help them to prevent future competition.
FYI Samsung was paid by MS to add DRM to the Galaxy devices ~2010. Source: I was part of the team that had to implement the customer-facing part, carrier billing integration and backend 4-way revshare accounting in zero time. Harder than it sounds, and probably never repeated since unless you're preloading it's against terms to introduce payments on Android. IIRC the real heroes were the Indian embedded engineers who were 10x better than the Koreans.
If you're someone building an app/service that uses licensed content, you're going to be subject to their demands put forth in the agreement. If they say you use DRM, you use DRM. You can be against DRM, but you'll have an app/service with lame content.
Yes. The demands are stupid and useless. Nonetheless, some idiot put them down and into the licensing agreement. And that makes you the idiot tasked with fulfilling them.
> how modern economics eliminate waste and inefficiency, this kind of DRM stands out as a counterexample
Ironically it's a product of the made up concept we call intellectual property that legal teams like to "protect" because they can ask the government to enforce their monopoly over the idea.
Ironically it's a product of the made up concept we call intellectual property that legal teams like to "protect" because they can ask the government to enforce their monopoly over the idea.
How is it that articles about DRM have people like you commenting who are critical of IP (I'm not disagreeing with you on that), but articles about AI being trained on GPL code, books, and art are full of people complaining about IP rights not being respected. Why don't the commenters cross-pollinate so the pro-IP guys can come here and say "We need DRM to protect artists' livelihoods" and the anti-IP guys can go there and say "AIs are doing God's work making information free like it wants to be".
Because both are really just totems for an actual discomfort about rent-seeking capital operating in abstract realms that just tangentially touch some relatable life experience.
Oh. Now that explains basically all the popular but inconsistent or controversial beliefs people have. I guess it's why you can't reason with someone about a political issue - the issue isn't the thing that's important to them, it's something more abstract that it represents.
Digital Restrictions Management has nothing to do with modern economics. It is political and legal theatre.
Most of those Stallmanesque nicknames feel kinda childish, but this one is so spot on that it always takes a moment for me to realize that it's not how it was originally named when I see it being used.
> It never stopped a thing. Clearly, it only exists to cover someone's arses and check some boxes off the requirement lists.
Yes, and traffic lights and speed limit signs have no physical mechanism of stopping a driver directly, those who violate them escape without consequences 99%+ of the time, and the 1% that get caught are only penalized after they physically did so already. Clearly, security theater at its finest.
To go even further, only 54% of murders get cleared. 46% are never cleared. Which shows, clearly, the rule against murder is ludicrously ineffective security theater. What's the point of a law that only works on a coin flip, am I right?
Yes, and traffic lights and speed limit signs have no physical mechanism of stopping a driver directly, those who violate them escape without consequences 99%+ of the time, and the 1% that get caught are only penalized after they physically did so already. Clearly, security theater at its finest.
To go even further, only 54% of murders get cleared. 46% are never cleared. Which shows, clearly, the rule against murder is ludicrously ineffective security theater. What's the point of a law that only works on a coin flip, am I right?
If your law enforcement does as much to prevent or deter murder as DRM does to prevent or deter video piracy, oh boy do I not want to live in your city. I'm not sure who would. Maybe all the serial killers?
Thank you for admitting that laws against murder, despite a 46% failure rate, are effective.
> It never stopped a thing.
Imperfect does not mean ineffective. Every time you make something more difficult it reduces the number of people who will do it.
Pardon my 1990s metaphor, but:
* If you have no DRM and people can just share the install disk, they will do that and piracy will be universal
* If you implement a CD check, yes, people with CD burners can bypass it but those are far fewer. Yes, industrial shops can mass-produce pirated CDs but not everyone is willing to buy those.
* If you implement even more stringent restrictions such that duplicating the CDs is significantly harder (to continue the metaphor, do something weird with the sectors that requires CloneCD instead of more generic ISO-ripping software) and now you're down to people with specialized hardware/software
* If you go further and implement software DRM checks, they can be bypassed, but now we're down to the portion of the market willing to download sketchy crack programs that totally aren't viruses, the host of the website swears. This is a *much smaller* group than those that would just grab an official install disc from their friends.
etc., etc. These measures do not have to be perfect to be effective. There can still be pirated copies available, but if the effort to get to them is sufficiently higher than buying the official copy (and that threshold is different for different people) they have served their purpose.
Most techie people I know ripped their DVD collections. Many ripped their Blurays but plenty didn't because it requires specialized software to get around the DRM. Only a handful of them have ripped their UHD discs which require specialized software AND specific hardware AND flashing a specific firmware on that hardware.
Imperfect does not mean ineffective. Every time you make something more difficult it reduces the number of people who will do it.
Pardon my 1990s metaphor, but:
* If you have no DRM and people can just share the install disk, they will do that and piracy will be universal
* If you implement a CD check, yes, people with CD burners can bypass it but those are far fewer. Yes, industrial shops can mass-produce pirated CDs but not everyone is willing to buy those.
* If you implement even more stringent restrictions such that duplicating the CDs is significantly harder (to continue the metaphor, do something weird with the sectors that requires CloneCD instead of more generic ISO-ripping software) and now you're down to people with specialized hardware/software
* If you go further and implement software DRM checks, they can be bypassed, but now we're down to the portion of the market willing to download sketchy crack programs that totally aren't viruses, the host of the website swears. This is a *much smaller* group than those that would just grab an official install disc from their friends.
etc., etc. These measures do not have to be perfect to be effective. There can still be pirated copies available, but if the effort to get to them is sufficiently higher than buying the official copy (and that threshold is different for different people) they have served their purpose.
Most techie people I know ripped their DVD collections. Many ripped their Blurays but plenty didn't because it requires specialized software to get around the DRM. Only a handful of them have ripped their UHD discs which require specialized software AND specific hardware AND flashing a specific firmware on that hardware.
The vast majority of DRM protected content (or at least majority by watch time) available in UHD via torrent in a matter of hours.
People like to stay away from torrents, because it carries significant risk in many jurisdictions.
But the only reason UHD versions are only available via torrent and often not as streams or downloads is bandwidth cost.
I can't see how it has any thing todo with DRM.
The only thing it maybe cut's down is sharing within friend groups. But even then it only takes one to figure out how to set up a VPN for torrenting.
The whole point is that if it is so easy everyone can do it without asking, it will be more widespread than if there are hurdles in the way, no matter how minor.
"Cutting down sharing in friend groups" is exactly what they hope to achieve.
"Cutting down sharing in friend groups" is exactly what they hope to achieve.
I have so many people watching off my plex that I should start charging them for second ISP line. And most of my friends are not technical people. This is my way of saying that streaming is available a well.
>>Most techie people I know ripped their DVD collections. Many ripped their Blurays but plenty didn't because it requires specialized software to get around the DRM. Only a handful of them have ripped their UHD discs which require specialized software AND specific hardware AND flashing a specific firmware on that hardware.
>The vast majority of DRM protected content (or at least majority by watch time) available in UHD via torrent in a matter of hours. People like to stay away from torrents, because it carries significant risk in many jurisdictions.
Sounds like you're proving his point? If stripping DRM is so trivial that anyone can pop in a bluray and rip it (like ripping CDs in itunes), piracy would arguably far worse. Pirates today have to brave shady torrent sites and the risk of getting C&D letters. Asking your friend to make a copy is far more accessible.
>The vast majority of DRM protected content (or at least majority by watch time) available in UHD via torrent in a matter of hours. People like to stay away from torrents, because it carries significant risk in many jurisdictions.
Sounds like you're proving his point? If stripping DRM is so trivial that anyone can pop in a bluray and rip it (like ripping CDs in itunes), piracy would arguably far worse. Pirates today have to brave shady torrent sites and the risk of getting C&D letters. Asking your friend to make a copy is far more accessible.
No. The bottleneck isn't "getting the files", it's sharing them.
If you can ask a friend with basic tech know-how to "rip a CD", you can also ask a friend with basic tech know-how and a VPN to "rip a movie".
If you can ask a friend with basic tech know-how to "rip a CD", you can also ask a friend with basic tech know-how and a VPN to "rip a movie".
>No. The bottleneck isn't "getting the files", it's sharing them.
It's that hard to upload a file to google drive and share a link? Is your model of the average person a bumbling idiot that struggles to do anything other than opening tiktok and flicking up?
It's that hard to upload a file to google drive and share a link? Is your model of the average person a bumbling idiot that struggles to do anything other than opening tiktok and flicking up?
Have you seen the average person trying to use technology?
I mean, a real average person, in a natural environment. Not in a movie or in stock footage. The real deal.
I have, and, holy shit. I cannot find the words to express just how unsettling it was of an experience. I still haven't fully recovered from it.
I mean, a real average person, in a natural environment. Not in a movie or in stock footage. The real deal.
I have, and, holy shit. I cannot find the words to express just how unsettling it was of an experience. I still haven't fully recovered from it.
> Pirates today have to brave shady torrent sites and the risk of getting C&D letters. Asking your friend to make a copy is far more accessible.
Or torrent through a VPN, which many people have access to already.
Or torrent through a VPN, which many people have access to already.
With streaming content, the barrier to just copying it is already as high as pirating. You don't just have a file you can email to your friend -- you have to install and use software to capture the video and then handle the big file that results, on your phone, which is awkward. And that just gives you one movie which in isolation is barely worth anyone's attention to begin with. By the time you've figured out all that, you could have just figured out how to torrent, or even easier, find a free Chinese website that streams the pirated content to your browser just like the original service.
Pretty much. The path of "figure out how to screen capture the entire DRM-unprotected movie as a video and send that entire file" has about the same level of resistance as "find a link to a pirate streaming site that already has the movie on it and send that link". Maybe more.
>The path of "figure out how to screen capture the entire DRM-unprotected movie as a video and send that entire file" has about the same level of resistance [...]
The biggest flaw with this logic is that screen capturing tools specifically don't work on DRM protected content. Moreover if you're trying to imply making a screen recording is some sort of black magic to normies, you must be living in the 2010s. Nowadays both iOS and Android have built-in screen recorders, and on desktops you can use something like loom, which works off a browser.
The biggest flaw with this logic is that screen capturing tools specifically don't work on DRM protected content. Moreover if you're trying to imply making a screen recording is some sort of black magic to normies, you must be living in the 2010s. Nowadays both iOS and Android have built-in screen recorders, and on desktops you can use something like loom, which works off a browser.
The biggest flaw with your logic is the utter lack of it.
If I could rip K-Pop Demon Hunters with a screen capture app to obtain a file I could share with a friend, I still wouldn't do it. Because finding a torrent is simpler and faster. I would get a very similar file, but so much faster, because I didn't have to keep the screen running at x1 for the full duration.
And finding a shady website that has it available is simpler and faster still.
If I could rip K-Pop Demon Hunters with a screen capture app to obtain a file I could share with a friend, I still wouldn't do it. Because finding a torrent is simpler and faster. I would get a very similar file, but so much faster, because I didn't have to keep the screen running at x1 for the full duration.
And finding a shady website that has it available is simpler and faster still.
>If I could rip K-Pop Demon Hunters with a screen capture app to obtain a file I could share with a friend, I still wouldn't do it.
Well no, because the lack of DRM wouldn't just mean you can manually screen record netflix. It also means you (or someone else) can write an app to screen record netfilx for you, or skip that altogether, similar to something like yt-dlp. After all, if somebody wants to rip youtube (DRM free), they don't screenrecord it, they find some random website/tool off google.
Well no, because the lack of DRM wouldn't just mean you can manually screen record netflix. It also means you (or someone else) can write an app to screen record netfilx for you, or skip that altogether, similar to something like yt-dlp. After all, if somebody wants to rip youtube (DRM free), they don't screenrecord it, they find some random website/tool off google.
YouTube is not just DRM-free, but cost-free. One of the things you can pay for is "enhanced bitrates", and while you can yt-dlp them if you auth (maybe?), you won't find the random download sites offering it.
Even if money is no object, if you want to watch bluray-quality 4K content your only choice is to buy the physical media and get it shipped to you (and then use some horrible proprietary player interface). I'm not aware of any streaming services offering the same bit-rates at any cost.
Then you didn't look very hard.
https://www.kaleidescape.com/
There are a couple others as well.
https://www.kaleidescape.com/
There are a couple others as well.
In my case, the in-browser DRM is what is making things more difficult. Whenever something uses the DRM checks, one or both of my monitors turn off. I am not interested in troubleshooting this beyond disabling DRM in my browsers. I don't generally pirate any media, but it might actually be easier than troubleshooting this hardware problem.
> If you have no DRM and people can just share the install disk, they will do that and piracy will be universal
There are plenty of consumers who are happy to pay a reasonable price for an easy-to-access product.
The question is, does adding DRM onto your product push more of those consumers towards piracy than it does towards paying...?
There are plenty of consumers who are happy to pay a reasonable price for an easy-to-access product.
The question is, does adding DRM onto your product push more of those consumers towards piracy than it does towards paying...?
https://widevine.com/solutions/widevine-providers
And surprise surprise, the blog post in question appears to be very thinly disguised marketing for one of those third parties.
Also, the Google service was free and came with no SLA or support, meaning anybody remotely serious about DRM was not relying it on in the first place.