◐ Shell
clean mode source ↗

Three years after the W3C approved a DRM standard, it's no longer possible to make a functional indie browser

Cory Doctorow

Back in 2017, the World Wide Web Consortium (W3C) approved the most controversial standard in its long history: Encrypted Media Extensions, or EME, which enabled Netflix and other big media companies to use DRM despite changes to browsers extensions that eliminated the kinds of deep hooks that DRM requires.


At the time, the Electronic Frontier Foundation warned that, by approving its first non-unanimous standard, the W3C would give control over browser design to the big browser companies, and two years later, that warning has fully proven out.


First, Google — whose proprietary technology must be licensed in most cases if you want to make a new browser — stopped permitting open source browsers to use its DRM technology, effectively requiring all new browsers to be proprietary.


Now, Microsoft and Apple — the remaining two vendors who can also supply the proprietary components that Google won't license — have effectively stopped answering the phone when small browser creators call. Microsoft might let you license its tools if you pay them $10,000 to submit an application and then $0.35 for every browser you ship.


Samuel Maddock has been trying to create a rival "indie" browser, and has been to each of the EME DRM vendors and has been sent away by all of them.


The W3C's mission is to create an Open Web Platform" so that "everyone has the right to implement a software component of the Web without requiring any approvals or waiving license fees." When EME was approved, we warned that they were effectively ending the Open Web era by putting every future browser developer at the mercy of three giant incumbent browser developers.


And here we are.


Next up: watch for lurking software bugs in EME that compromise user security and privacy to go unreported while they are exploited by criminals and spies. DRM laws like Section 1201 of the DMCA allow software vendors to threaten whistleblowers who disclose bugs without permission with both civil and criminal liability, and the W3C specifically turned down every single proposal to make its members promise not to abuse this power — even when those members signalled that they viewed the power to decide who could criticize their products as a feature of the EME process, and not a bug.


The web is not merely reduced to five giant sites, each filled from screenshots from the other four, it's also a near-monoculture of browsers, almost all of them controlled by tech giants who have been complicit in both commercial and state surveillance, including surveillance by the world's most notorious torturing and murdering autocracies.

The W3C's decision to hand these monopolists perpetual Internet Domination Licenses was the gravest mistake in its history, just when we needed its principled leadership the most. We are living in the aftermath of that decision today and things will get worse long before they get better.


Meanwhile, the W3C's own page on EME is completely silent on the most controversial standarization process in the organization's history.


Since the introduction of EME to web standards, the ability for new browsers to compete has become restricted by gatekeepers, which goes against the promises of the platform.

Using the Open Web Platform, everyone has the right to implement a software componet of the Web without requiring any approvals or waiving license fees.

Yes, the EME standard can be implemented by anyone, but it's moot when the requirement of a CDM says otherwise.

The End of Indie Web Browsers: You Can (Not) Compete [Samuel Maddock]