https://widevine.com/solutions/widevine-providers
And surprise surprise, the blog post in question appears to be very thinly disguised marketing for one of those third parties.
Also, the Google service was free and came with no SLA or support, meaning anybody remotely serious about DRM was not relying it on in the first place.
To be fair, there is no official Google announcement to link to. They seem to have announced this very quietly and it is easy for someone to go to the Widevine docs and build something around the server without realizing it’s going away.
It never stopped a thing. Clearly, it only exists to cover someone's arses and check some boxes off the requirement lists.
And yet, some people put actual effort into integrating it, and keep shipping mandatory DRM modules that run with deranged levels of privilege in places like TrustZone. They keep restricting some browsers and phones from being able to view Full HD content - despite that Full HD footage being on every shady pirate streaming website that runs on ads for online slot machines and penis enlargement pills, and the 4K versions of that very same content being available day 1 in any torrent search engine. Because some cheeky madman somewhere has a few exploits, and one exploit is all it takes for DRM to stay broken forever.
Punish the legitimate users, and completely fail to deter the pirates. Security theater at its finest.
Every time I read of how modern economics eliminate waste and inefficiency, this kind of DRM stands out as a counterexample. It never worked and never will - nonetheless, here it is.
Some people keep writing and signing the licensing deals with those stupid requirements that don't touch reality in them. Other people keep needing to fulfill them. And so, the strange useless cover-your-arse-ware lingers in every device, like the smell of stale piss in a public toilet. With no care for how unwelcome it is.
Funnily enough it works better as a deterrent against releasing an Android device without Google being involved than protecting media.
They're inventing the cool hardware and infrastructure, but for some reason, they let the content people dictate terms. I want to see the LGs and Samsungs of the world announching "we're making this amazing 16k OLED panel, and the only interface it has is unencrypted DisplayPort. If you don't want to your precious movies on it, there are still stock traders who will buy it to fill with graphs or programmers who will fill it with StackOverflow tabs and vim windows."
Sure, Sony could try to make some sort of sealed box viewing system that never let the raw bitstream out-- by the darkness, they've spent the last 30 years trying-- but most of the content firms don't have the technical chops or the market power to make it happen. I can fully imagine them trying to sell multiple different set-top boxes, each of which is only capable of decoding one studio's DRM.
On the other hand, what ended up liberating the music market wasn't some grand audiophile product, it was the market full of $29 no-brand/minor-brand "MP3 players". It was such a fragmented market, running random bare-metal firmware on the cheapest MCUs available, that nobody except Apple could possibly make a play out of selling anything but DRM-free content.
What's "deranged" about TrustZone? It's just a way to allow code to be executed in a tamper-proof way. Advocates like Stallman might object to this on the basis of "freedom to tinker" and "user control", but it can't steal your data, which is what "deranged levels of privilege" sounds like.
Moreover it's not too hard to imagine DRM implemented in a way that doesn't have those issues. The most obvious example would be some sort of dongle that handles decryption and forwards it to a TV. In other words, a chromecast. It'll still be a black box, but I doubt anyone seriously cares. You can make a case about how your computer or smartphone should be "open", but the case is far less persuasive for a media dongle.
A less awful design would have been to keep the security code at EL2 and have CPU hardware that can isolate two EL2s from one another[1]. This is ultimately what ARM wound up doing with S-EL2, but you still need to have EL3 code to define the boundary between the two. At best the SoC vendor can design a (readable/auditable!) boot ROM that occupies EL3 and enforces a boundary between secure and non-secure EL2s.
[0] Or, at least, TrustZone's secure monitor. TZ can of course run secure code at lower privilege levels, but that doesn't stop a TZ compromise from becoming a full system compromise.
[1] If you're wondering, this is morally equivalent to Apple's guarded exception levels.
They could perfectly refuse them, and de-facto DRMs would be marginalized, to a point it would not even be an option.
They are, in fact, the big media themselves now. They have the power, and more than enough of it. No streaming service can afford to skip having an app on iOS or Android - all Apple has to do is crack the whip. Say "this DRM is no longer compliant with our device policy and will be phased out by 2030" and there goes that.
But they still act like they're weird web teens who can't raise a voice against the big media boys without getting bullied for it.
That, or they believe this DRM charade serves them - and user experience can go suck a dick.
Ironically it's a product of the made up concept we call intellectual property that legal teams like to "protect" because they can ask the government to enforce their monopoly over the idea.
Yes, and traffic lights and speed limit signs have no physical mechanism of stopping a driver directly, those who violate them escape without consequences 99%+ of the time, and the 1% that get caught are only penalized after they physically did so already. Clearly, security theater at its finest.
To go even further, only 54% of murders get cleared. 46% are never cleared. Which shows, clearly, the rule against murder is ludicrously ineffective security theater. What's the point of a law that only works on a coin flip, am I right?
Imperfect does not mean ineffective. Every time you make something more difficult it reduces the number of people who will do it.
Pardon my 1990s metaphor, but:
* If you have no DRM and people can just share the install disk, they will do that and piracy will be universal
* If you implement a CD check, yes, people with CD burners can bypass it but those are far fewer. Yes, industrial shops can mass-produce pirated CDs but not everyone is willing to buy those.
* If you implement even more stringent restrictions such that duplicating the CDs is significantly harder (to continue the metaphor, do something weird with the sectors that requires CloneCD instead of more generic ISO-ripping software) and now you're down to people with specialized hardware/software
* If you go further and implement software DRM checks, they can be bypassed, but now we're down to the portion of the market willing to download sketchy crack programs that totally aren't viruses, the host of the website swears. This is a *much smaller* group than those that would just grab an official install disc from their friends.
etc., etc. These measures do not have to be perfect to be effective. There can still be pirated copies available, but if the effort to get to them is sufficiently higher than buying the official copy (and that threshold is different for different people) they have served their purpose.
Most techie people I know ripped their DVD collections. Many ripped their Blurays but plenty didn't because it requires specialized software to get around the DRM. Only a handful of them have ripped their UHD discs which require specialized software AND specific hardware AND flashing a specific firmware on that hardware.
There are plenty of consumers who are happy to pay a reasonable price for an easy-to-access product.
The question is, does adding DRM onto your product push more of those consumers towards piracy than it does towards paying...?
