Reply All - #90 Matt Lieber Goes to Dinner

Episode Date: March 2, 2017

This week, one man has been warning the world about an impending disaster for years, but no one will listen. Also, Alex makes a dumb decision. Further Reading W3C's proposed standard W3C Director, Tim Berners-Lee, posts "On EME in HTML5" Mozilla's blog post "DRM and the Challenge of Serving Users" Cory Doctorow's post "The World Wide Web Consortium at a Crossroads: Arms-Dealers or Standards-Setters?" Learn more about your ad choices. Visit podcastchoices.com/adchoices

From Gimlet, this is Reply All. I'm Alex Goldman. And I'm PJ Vote. This week, Fia Benin, Reply-All producer. She's in the studio with us. Hi, Fia. Hi. And what have you got for us?

Yeah, lay it on us. So, I don't know if you guys remember this, but last spring, our boss, Matt Lieber, went to a dinner and sat next to this guy who told him that this thing was about to happen that was going to change civilization as we know it. Do you remember that? I don't remember that. Matt Lieber goes to a lot of dinners and has like, he'll be like, he'll be like,

what are you up to, Matt? And he'll be like, I was at this dinner and I talked to a very, a very unique man from a very far away place. And he told me a very troubling thing. Like the details change, but like, right. The man goes like dinners with thought leaders. He goes to dinners with chicken little every night. Yeah.

It's just like, this guy is falling. So I called up this guy that Matt was sitting next to it that day. His name is Corey Doctoro. We know this guy. Yeah. He's a weird combination of things. Like he writes novels. He writes...

Science fiction novels. Science fiction novels, like, he does boing, boing. So he has a lot of internet journalism stuff. Basically, like, if the internet were a bar, Corey would be, like, a regular at the internet. Yeah, he'd be like a person everybody knew and kind of admired. Right, right. And, like, the problem for him right now is that he's, like, the guy at the bar who

keeps going up to people and trying to talk to them. and they're like avoiding him. Because he's drunk. Because he keeps trying to tell people about this thing, like the thing he told Matt Lieber about. But it's just like people keep finding it like so complicated and technical. It's one of those things that is amazingly important and also protected by this shield of boringness

that keeps it from being, you know, understood and acted on. And isn't that category of like, fantastically dangerous things because it's super urgent and really hard to get your head around. But I've been talking to Corey for almost a year now about this, just like trying to understand it, asking a bunch of internet experts about it. And now I'm going to try and take like everything I've learned and compress it and probably simplify it a little bit, but explain it to you. And I'm going to try and do it in like 10 minutes. Okay. Okay. So Corey is like locked in this battle that, I mean, really is literally just about how we watch video on the internet.

And Corey says that the stakes for this like could not be higher. Like if the bad guys win, it could have catastrophic consequences for the internet. Who are the bad guys? So the thing is that the bad guys for Corey, they're actually like really good guys. All they're trying to do is make sure that the internet can run like, as smoothly as possible for like everyone in the world. Uh-huh. They're this group called the W3C.

It stands for the World Wide Web Consortium. I'd never heard of it either. Okay. Yeah, no, yeah, not at all. And like their whole job is that they're trying to create like one language for the internet so that like my computer can talk to your computer. Uh-huh. I talked to one member, his name's Adrian Bateman, and he told me like how they spend their time.

We agree on, like, is it called picture or is it called image? You know, in the HTML language, which is the language of web pages, we actually use IMG as an abbreviation for image. So part of what the W3C does is you guys are like the Webster's dictionary saying, like, we spell color with a U or without a you. And then you're also doing like the, this is central. structure. This is grammar. This is like, here's how we define the building blocks and here's what they are. Yes. So that's an example of the kind of thing that the 400-some members of the W3C are working on and arguing about. I talked to another guy. His name is also Adrian. He's Adrian Roselli. And he said a lot of those debates happen on conference calls. Are the calls fun? Like the whole thing. No. No. Somebody keeps minutes. We have an agenda. we run through everything, we table stuff, we miss the ball and other things and put them off to the next meeting.

Some calls are great. And some calls, it's just a slog. It's just, I don't want to be here. I could be driving a screwdriver into my knee, but instead I'm on this call. Wow, that sounds like you should hang up. If it feels like that, that sounds really bad. So, okay, now I want to tell you about this one little fix that the W3C is considering that Corey thinks, could actually be like the end of everything. So you know how, like in the past, when you've wanted to watch a video online, if you wanted to watch like a movie on Netflix, sometimes it would be like gray screen,

you need to update your silver light. Yes, this is the bait of my existence. It's not actually Netflix, it's Amazon. Amazon is constantly like, Microsoft Silverlight needs to update, which is crazy because I don't know what it does. I assume it's like in a national, annoying private, like a thing for them, not for me.

Mm-hmm. And it is constant. Yes. Like, constant. Can I tell you that like multiple times, not only in my life, but this year, I've bought a movie or a television show online, run into something like a Silverlight update, and then pirated it because I felt like I don't want to go through whatever crap you want to put on my computer, I don't want.

Uh-huh. I'm happy to have paid for it. Yeah. But like I'm not going to, I don't want your weird invasive crap. Which is reasonable and normal. Which, I mean, the funny thing about Silverlight is it's a way for you to watch videos online. But the actual intention is to like wrap up the movies in a way where like they are protected and secure and people can't steal them. It's this thing called DRM.

I know DRM. It stands for digital rights management. And it's like a thing that basically since the beginning of the internet companies have been doing to try and keep people from copying stuff. So a lot of DVDs will only allow you to make one or two copies of it before it stops letting you make more copies. There are certain CDs that they make it hard for you to actually pull music off of. Right. So like the whole purpose of it is just to like stop you from pirating stuff. Which is not working.

Certainly isn't really working for you. So the W3C is like you're sick of updating Silverlight, you're sick of updating Flash. we have great news. We have this new DRM and we're going to put it directly into your browser. You're never going to have to worry about updating Flash again. But here's the catch. And it's kind of a big catch,

which is it's going to be everywhere. It's going to be in every phone, in every computer. And if you imagine your computer kind of like your house, it's like every house is going to have the same kind of lock on the front door. And they're saying it's going to be the best lock. It's going to be like super secure. have all the dead bolts you want, like, the perfect lock, which if they're right is like fantastic. But Corey says if they're wrong, we're not going to know that they're wrong because outside security experts, like, they can't look at this thing.

It's like the big plan to protect this lock is just like, don't look at the lock. Don't try to break the lock. Like you're just not allowed to? Well, basically, because there's this copyright law that actually says like security researchers. are not allowed to get anywhere near locks like this one. Oh, that does feel as bad as he thinks it is, honestly. Yeah, and Corey says this is a real law, and it's been enforced before. So there was this programmer named Dimitri Skilyerov, who worked for a company called Elkimsoft.

He was Russian. And he came to America to give a presentation at a tech conference about Adobe's ebook reader. And Adobe had made this ebook reader that promised that you wouldn't be able to copy the text. And Dimitri found that it was made very, very badly. And so he did what security researchers always do when they find a bug in software that is allegedly secure, which is that they disclose it. He went on stage at this conference and he told people like, here's this flaw. And the FBI arrested him. What?

Yeah. The FBI arrested him for copyright infringement? Yeah. Basically, and he ended up going to jail. That's so ridiculous. He struck a deal with the feds and went back to Russia. What are you in for? A paper I presented at a college symposium.

Yeah. What about you? And Corey said he was actually at Dimitri's release party. What was he like? He was a quiet Russian guy. He was a nerd. He was a programmer like all the programmers I knew. He didn't, he wasn't Neo.

He was just this guy who had been to jail in America and wanted to get the hell out and go back to Russia. So Corey's like, what if they decide to do the same thing now with this encrypted video player thing? Like, what if they decide to try to arrest anyone who's pointing out a problem with it? He told me, like, in one of our many conversations that we had over the last year, the security people are really, really freaked out about this. There are lots of people around the world who discover bugs and sell them to governments, right? They weaponize them and they sell them to governments instead of reporting them to the company or publishing them to the public.

So if it's a really bad defect, you know, you might be able to seize control of the whole computer. Or maybe you can just take over the browser, in which case you can do things like log credit card numbers and turn on the camera maybe, depending on how the browser and the camera are interacting with each other. If the browser has location access, you can get that. If you can get passwords, you can do all kinds of things. Now, is there any reason to fight for this? Because what you're describing is like a portal that everyone's going to be attacking that no one is allowed to look at. And I can't understand why this is better than the current system. Yeah, right. And, you know, it's not the sort of thing that the W3C would normally support.

This is the first time that they're recommending a standard, like new internet code that nobody would be allowed to look at. But Corey has a theory about why the W3C is considering this, and it has to do with some new members that joined in the last few years. Members like Netflix and YouTube and Viacom. Giant media companies who forever have not liked the wide openness of the web and have been calling since the web's inception

for controls on how the web works to make their business models more viable, see an opportunity. Which is to say an opportunity to add DRM to things. Like remember, DRM is that little piece of encryption that stops users from messing with their pirating things. So Netflix shows up at the W3C and says we would really like DRM in browsers

and then strongly implies that in the absence of DRM in browsers, there will be no Netflix in browsers. And Netflix is a thing that a lot of people are convinced they need in order to have a viable product. We just, we have to play ball with Netflix. Netflix feels so strongly about this that they're actually helping to make the lock that the W3C is suggesting everybody use. Like Netflix and Google and Microsoft, that's who's writing it. Which is crazy because their whole thing is like, we're going to build this. it's going to be perfect. It's going to replace all the crap that exists right now.

The crap is Silverlight. Microsoft made Silverlight. Right. Like, why would the perfect thing... That's crazy. Yeah, I know. And, like, the whole time I'm trying to learn about this, I just really wanted to get the perspective of the media companies.

And, you know, I reached out to, like, Netflix and YouTube and the Motion Picture Association, and nobody wanted to talk to me. Huh. But one group that did get back to me was Mozilla, who makes Firefox, one of the Browns, Yeah. So they're particularly interesting to me because they're like in the middle of this fight.

There's like on the one side there's like the users like us who are just like watching movies. And then on the other side there's like the media companies who are providing movies. And Mozilla, they're just like a platform in the middle of it all. They got to get along with everybody. Yeah, they're trying to keep like everybody happy. And that's kind of their role. But it's put them in this very difficult position. So I talked this woman named Dinell Dixon.

Her title on Mozilla is Chief Legal and Business Officer. Uh-huh. And she told me that even though Mozilla really does not like this lock thing, it makes a lot of sense to her why companies like Netflix would. The content owners, the ones that produce this content that is, it's their content. It's copyrighted content. It's content that they've spent creative energy putting together. and they should be able to monetize this content

and to protect that content from being, in their mind, from being distributed in ways that they don't authorize. We actually, as Mozilla, think that that's true. Like, they're content owners and they should be able to protect it. But there are other ways to go about protecting the content. Mozilla would like any other option besides this one. Because on top of everything else, what their company stands for is openness and transparency.

For example, Firefox is famously the open source browser. Right. But at some point they realized they can either go along with this or die. So it was a really tough decision and it was one we didn't take lightly at all. We recognized that this is hostile to users. The locking system is hostile to users. From the standpoint of, you know, in our browser, you'd put this closed source component in there that's getting information and data about your devices.

And we also are all about transparency. And so that was a problem for us. But after a lot of debate, they decided, okay, we'll put it in. Does that mean there's code in Firefox that Mozilla can't look at? Like, that you can't look at? Right. So we can't get into the black box of the DRM of the locking system either. Does that feel kind of weird?

Yeah, I mean, this is part of the challenge that we had. It's that here's the, I'm going to give you the really simple perspective on this. If we didn't, if we chose not to put this locking system, black box or not, into our code, then we obviously, our users would go to other browsers because they need to be able to, they want to be able to watch this content. Meaning if you want to watch Stranger Things and you can't watch, it on Firefox, you're going to go somewhere else. And so now, because they agreed to this, Firefox has this little piece of code

inside of it that is encrypted. That must drive them nuts. That's all they care about. Yeah, I mean, she said it felt really bad. She said, like, a lot, like, it was sad. It made her sad. That is, like, the thing that, to me, helps me understand the bigness of this. because the internet, as it's always existed,

has been this thing that like the architecture, you could always see the beams that held it up. And if it seemed like there was anyone that was weak in any particular way, other people would point out that weakness and help fix it, weld it back together. And now it feels like video, which is now a huge part of the architecture of the internet,

If that is no longer visible, like it just seems like it's like a fundamental shift to me. Yes, I think it's a really big deal. So what is going to happen? Like what happens now? So Corey says he's going to keep fighting this. Like he is not stopping. He's collected the coalition of people who are all fighting with him. And like at this point they've been fighting this for three years now.

They're just doing everything they can to make it as difficult. as possible for the W3C to make this like the law of the land like a universal standard. But what's the like, is there like a showdown point? Do you know what I mean? Yes. So they've been like gearing up for a vote like between W3C members. And they've been thinking that but will probably happen like April 1st. And I thought that's where things stood. Like that's what I was expecting to tell you today. And then when I I was like, when we were all preparing to come in and I was going to explain all of this to you, actually right before I came in, this huge thing happened, which is that the director of the W3C posted a blog post saying like, he has an opinion on this. He's weighing in. And what he said was this thing that Corey hates, he said the W3C should go through with it. So I emailed Corey and he was like, I saw this.

And I immediately sent an email out to the head of the W3C saying, like, are we still going to have a vote? We always have a vote. And he hasn't heard back. Wow. So that's where it stands right now. That's intense. So, of course, like, I'm going to stay in touch with Corey. I'm going to be watching what's going on.

And I will tell you guys as soon as I know anything else. Cool. Thank you. Thanks for explaining. You're welcome. Coming up after the break, possibly the worst idea we've ever had. Welcome back to the show.

All right, Alex. Yes? I've been thinking about something very... I've been thinking about something lately. Okay. I've been thinking about Donald Trump's cell phone. What about it? Basically, since Donald Trump was elected president,

I keep seeing these computer security experts online who I follow, who are really upset because there's one very specific thing that Donald Trump is doing, which is that when he tweets, he'll often tweet from his phone, and his phone is just like a crappy old Samsung galaxy. It's not like a special, secure president phone. And they think he needs a special secure president phone. Right. And this is not a thing that I found, like, of all the things in the world to worry about, I did not feel worried about this. But then, last week, I saw this piece by this vice writer. And he just

wanted to find out, like, how easy is it to hack a phone like this? And what can you do if if you do hack it. Mm-hmm. So he bought this software off the internet, which let him hack his own phone, which he said it took like a minute. And then he gave one of his friends access to it. Like basically he wanted to find out, you know,

what could he learn by intentionally hacking himself? Oh. And I thought that that was a really interesting experiment, but I thought it would be more interesting if I could find someone who would let me hack their phone. Yes. Can I really? Yeah, absolutely.

I really thought you were going to be, resistant to this. I have nothing to hide from you. That's amazing. So this is okay. You will do this. Yeah, totally. Do you have any, do I'm curious, like, do you have any anxieties about it at all? I mean, if I, if I think about it for long enough, sure. Don't feel like you have to think about it at all. Sure. But like, I really, for better or worse, you know, you know a lot of, of the dark recesses of my soul. Not only that, like, you're somebody who I'll be like, hey, can I log into, like, how do I get into such? You've given me your email password. I don't even remember it, but you've given it to me, I think, like, six times.

And I get the sense that's just like your password for everything. You don't have to answer that question. There is a Google Doc that is accessible to every member of reply all that has my password for everything in it. Whereas, like, for me, like, I feel, it's not like I'm like, oh, if someone were to get into my information, they would find blah. but I just have like, I don't know if it means that I'm like a more deceitful person than you probably. But like I just have like a basic medium anxiety. Like if somebody just like grabs my computer, I have a heart attack.

Because in my mind, I'm just like, that is my open brain. And like I don't know what you're going to see and what type of context you're going to put it in. You don't, do you have that? Generally no. I feel like you just say everything. Yeah, that's really what it is. Everything that I think just pours out of my mouth. unfortunately.

And that's why I'm so annoying to you. Yeah, that's true. Okay, so I think that it did not seem like it would be particularly worth it to say to Alex in this moment was that his understanding of what he's agreeing to and my understanding what he's agreeing to are super different. He's okay with the idea that I might have the ability to like read his emails. But this vice reporter, Joseph Cox, when he talked by the experiment, it sounded so much worse than what Alex was actually imagining. We were talking about, at the podcast where I work, we were talking about trying to do a version of the experiment. You did. The only difference being I talked to my co-host and convinced him to allow me to spy on him. And I'm not sure he completely understands the capabilities of the technology. He doesn't know what he's got in for, yeah. No, he was like, yeah, whatever. I don't care if you read my email.

I mean, are you really going to do it for 24 hours, 48 hours? Because, I mean, I'm dedicated to my job, but I honestly couldn't do that. One week, seven days. Oh, my God. Sorry, my mind has just gone into genuine cybersecurity mode. Yeah. He's going to get a shock, definitely. And once I'm in there, like once I've hacked into him,

What do I have access to? You have access to pretty much everything that this person would be using the device for. If they make a phone call, you'll get an email with who they called, when, and an audio clip of the phone call. If the GPS tracking is also enabled at the same time, you can easily see where they were when they made that call. And, God, that is so strange. Sorry. It's really fucked up. me and Joseph talked for 15 more minutes. You are not going to hear those 15 minutes, but in them, he introduced me to a laundry list of things that a person with bad intentions could do to another person's phone if they had access to it.

I am excited to try all of those things in the next week of Alex Goldman's life. The phone got here late today. We plan to start recording our experiment tomorrow, March 2nd, at 3 p.m. I'm very excited. we will have the results for you in an upcoming episode. Alex Goldman, you have been warned. Reply Al is hosted by me, PJ Vote, and Alex Goldman. Our show is produced by Shruthi Permanani, Fia Bennon, Chloe Prasinos, and Damiano Marquetti.

We were edited by Tim Howard and Jorge Just. We were mixed by Rick Kwan. Our theme music is by the mysterious breakmaster cylinder. Our logo is by Matt Lubchanski. Backchecking by Michelle Harris. Special thanks this week to Motherboard. They are also doing an episode about spyware for their new podcast, Plus Plus Podcast. You can check that out.

And special thanks to Mike Maznick, Chris Adams, Mark Gilbert, and Posey Doctoro. Also, if you're going to be at Texas for South by Southwest, me and Alex are going to be appearing at the Dropbox podcast studio on Sunday, March 12th. And if you're looking for a job, Gimlet is hiring right now. We are looking for great salespeople to help sell the ads on our podcasts. You can get more information at Gimletmedia.com. careers. Also, one final note on this episode, Mozilla, who appeared in the story you just heard, has advertised on our show in the past. Matt Lieber is a miraculous parking spot. You can visit our website at replyall.limo, and you can find more episodes of the show on

iTunes or Spotify or wherever you personally decide you would like to list a podcast. Thanks for listening. We will see you in two weeks. Dish.