Open-source LMS: affordable alternative to commercial DRM for protecting course videos?

[u/Able-Pass-6993]

​

We're building an open-source LMS and we're currently working on protecting paid course videos from being downloaded and redistributed.

Commercial DRM providers (Widevine / FairPlay / PlayReady) are quite expensive for a small/open-source project, so we're trying to understand what realistic alternatives exist.

Our requirements are roughly:

- Videos are uploaded by course creators.

- Videos should be streamed rather than exposed as directly downloadable files.

- Users should not be able to simply obtain the original MP4 URL and download it.

- Ideally, downloaded/encrypted segments shouldn't be usable outside our application.

- We want per-user authorization and short-lived access.

- We can implement the backend/key-management infrastructure ourselves.

- Self-hosted/open-source solutions are strongly preferred.

- We understand that nothing can completely prevent screen recording.

We've considered approaches such as:

- HLS/DASH

- AES-128 encrypted HLS

- Signed URLs

- Short-lived playback tokens

- Per-user/session keys

- Watermarking

- Combining several of these approaches

But we're unsure where the boundary is between "making downloading difficult" and actual DRM.

For a small open-source LMS, what would you recommend?

Are there any open-source/self-hosted projects or architectures worth looking at that can provide reasonably strong video protection without paying a commercial DRM provider?

Also, if actual Widevine/FairPlay/PlayReady DRM is unavoidable for strong protection, are there any affordable providers or pay-as-you-go options that make sense for a small project?

We're mainly looking for practical experience from people who have built something similar rather than a theoretical DRM explanation.

[u/artyomsv]

Boundary is simpler than it looks: does the decryption key ever reach userspace in clear. With AES-128 HLS it does, player fetches the key over HTTPS and anyone who can watch can grab that key and hand the playlist to ffmpeg, so it is obfuscation and not DRM. Widevine costs money precisely because the key stays inside a CDM that neither you nor the user controls. For a small project I would not chase that. Spend the effort on per user visible watermark instead, it does not stop ripping but it tells you which account leaked, and in practice that is what stops redistribution rather than the encryption.

[u/luenix]

You have to look into how platforms like Twitch work. Look at your network traffic when streaming there for a start :]

[u/notthedefaultnam]

We understand that nothing can completely prevent screen recording.

So what do you want to actually achieve? Making the experience of paid users worse? Cause you're already aware you can't actually stop downloads. If netflix can't do it, neither can you.

Will this make your service better?

[u/TheIncarnated → u/notthedefaultnam]

I'll answer for them. No.

Capture cards, using another device to record...

So name options that circumnavigates all DRM.

Just make a good service, make it accessible, preferably affordable and the people will come. The pirates were never going to pay for your cotent in the first place, don't cater to them