But why did you want plugin free Netflix to begin with?
Because Flash (and Java) are massive ongoing security concerns. Flash is too complex and has too much surface area, this new plugin even aside from being sandboxed, is simpler and with less surface area.
I am not saying that exploits won't be found here. I am just saying it may not be as bad as the continuously dripping tap that is Flash.
The EME DRM specification was authored by Microsoft, Google, and Netflix. Now that the other major browsers like Chrome, Edge, IE, and Safari implement EME and it is used by major content providers like Netflix, Amazon, HBO, and Canal+, Mozilla is backed into a corner.
Not that long ago, Mozilla tried to challenge H.264 on the Web. The Chrome team agreed to drop H.264 too, but they didn't keep their word and, without a public explanation, kept supporting H.264. When cat videos encoded in H.264 don't work in Firefox but work in Chrome, users switch to Chrome and may never come back. And now when video services people pay money for work in Chrome but not Firefox, users switch to Chrome and, again, may never come back.
> Not that long ago, Mozilla tried to challenge H.264 on the Web.
Ahh, hubris. They thought they could force the industry's hand with their market share... which was already starting to decline. By focusing on H.264 (and promoting Theora!), they succeeded in keeping Flash around as websites decided letting Firefox users stay with flash was easier and cheaper than listening to Mozilla's demands regarding <video>. Sometimes I hate bring right[1]...
What they should have done is dodge the problem by leaving the question of codec to the OS. Instead, Mozilla decided to drive users away. Which was also the obvious end result[2].
I understand (and support) making ideological decisions, but it's also important to pick you battles.
I agree that H.264 was not a fight that could be won, considering existing H.264 content and mobile devices' hardware support. But I'm sure the situation seemed more hopeful when 40% of the browser market (30% Firefox plus 10% Chrome, at the time) would drop H.264, especially when Google also owned YouTube and On2 Technologies (VP8).
Dodging the problem by leaving the codec support to the OS would fragment cross-platform compatibility if websites stuck with a Windows-only codec. Today, Firefox does use H.264, AAC, and MP3 decoders from the OS, but AFAIU doesn't expose any other OS codecs to web content.
Do you think the current situation with EME DRM is "H.264 all over again"? At least now, we can sandbox the DRM bits and dump NPAPI plugins. EME and CENC commoditize DRM, separating content encoding and DRM. Content providers don't need to reencode their video library to add support for new DRM systems.
No, it wouldn't have, in the long run. H.264 was chosen by the hardware manufacturers (phones, video cameras, etc), and the software world would have fallen in line. As they did.
Besides, any temporary problems could have been handled by a fix provided by not-Mozilla, just like how DVD support was enabled in many distros (by downloading libdvdcss from France).
> drop H.264
Believed the hardware industry would reverse years of designs based around H.264 is magical thinking. Software follows what the hardware supports (you are not going to get everybody to re-encode their cat videos). Anybody that believed that the browser market could trump the mobile phone market is showing they don't understand how de facto standards work. When Mozilla was arguing against H.264 5 years ago, they were already several years too late.
Screaming at the tide to turn back doesn't actually work, even if your intentions are good.
> VP8
...was future technology. Once it was actually released by Google with the WebM container it became a relevant option (which was a good idea to support in addition to H.264 that was already very commonly used.
The nonsense before Google released VP8 was merely wishful thinking. Much like how solar power advocates like to include "future improvments" in their claims, claims that H.264 was not needed usually suggested using VP8 while it was still vaporware.
> Today, Firefox does use H.264, AAC, and MP3 decoders from the OS
Which proves it is possible, and could have been done 5 years earlier to kill off Flash.
> but AFAIU doesn't expose any other OS codecs to web content.
They shouldn't, in general. Adding another list that can be probed for browser identification wold be a terrible idea.
> Do you think the current situation with EME DRM is "H.264 all over again"?
I think Mozilla is responsible for EME being completely accepted. Before announcing EME support, it was still possible to argue that EME was not supported by all browsers, an admittedly small reason for websites to not use EME. With Mozilla abandoning their mission (specifically principles #2, #6, and #7) to chase market share and become a Chrome clone, a major battle in the War On General Purpose Computing has been lost.
If Mozilla cared about the future of an open internet in the slightest, they wouldn't support any form of DRM, with no exceptions. THAT is the place a principled stand should have been taken, not video codecs. Instead, Mozilla has chosen to let others pick the battlefield. The claim was that this was necessary to safe their market share. Well, that didn't work[1].
Now that Mozilla has given up the fight against DRM, the problem will spread. The ebook industry already wants EME-like support.
Thanks for the information. I cede to most of your points, especially on codecs. :) A few more questions:
> Which proves it is possible, and could have been done 5 years earlier to kill off Flash.
How would HTML5 video, using OS codecs, kill Flash unless it also had DRM support? Flash has had DRM since 2007 (Flash Player 9).
> I think Mozilla is responsible for EME being completely accepted. Before announcing EME support, it was still possible to argue that EME was not supported by all browsers, an admittedly small reason for websites to not use EME.
Chrome shipped EME in 2013. Safari and IE shipped EME in 2014. EME content was already live and supported by ~60% of browsers when Mozilla began implementing EME in mid-2014. Perhaps Firefox could continue to lean on Flash and Silverlight to play DRM'd video.. until content providers decide they don't want to continue supporting NPAPI for Firefox's small market share. Flash is insecure and Silverlight is on the path to EOL.
> The claim was that this was necessary to safe their market share. Well, that didn't work
Whether EME has any effect on Firefox market share is yet to be seen. It just went live this week. Chrome or Edge users are unlikely to switch to Firefox because they want DRM video to stop working.
This is the problem with letting the opponent pick the battlefield. If you've decided that "playing DRM video" is a necessary feature, you are choosing to perpetually play catch-up.
"The only winning move is not to play."
The media industries are very used to being the middlemen that dictate how their industry works. As middlemen, they have the power to control both sides (publishers and consumers). As monopolists, they get to abuse the market by tying/bundling the things people want to the things they want to push ("if you want to watch $POPULAR_SHOW, you need to submit to using our DRM"). They also get to play various financial games, though that is less important re: video.
These problems are not technical in nature, and cannot be solved by writing software. Chrome and Edge are colluding to require some type of DRM (that they or their friends control)? They should face the Sherman and Clayton Antitrust Acts. Unfortunately, we have let institutional corruption take over the parts of government that should be enforcing those laws.
Choosing freedom instead of submitting to the copyright cartels requires sacrifice. Mozilla could help this with stuff like an educational campaign, but there will always be casualties when fighting entrenched powers.
Many people chose convenience instead of investing in their future, so now we are in an uphill battle. It's difficult to convince people that they should choose a healthy browser instead of the copyright cartel's junk-food, and I don't know of any great solutions.
What I do know is that giving up the fight and granting those middlemen even more power is only going to make future battles for free software and an open internet even harder. Do you want to tackle is problem now? Or do you want let power accumulate even more and fight a harder problem in the future?
Historically, leaving something with as large of an attack surface as video decoding up to the OSs to update hasn't really worked well for browser security.
You say “easily” – what was your plan for getting the web to move from Flash video playback to something else?
The W3C choice to standardize the mechanism for requesting DRM but not the actual system seems to be about as good as we could hope for without a magic want to get content owners to stop requiring DRM.
There are two different meanings of "plugin" being used here. The CDM plugin does just one thing (the DRM stuff) compared to, say, Flash, which is a gigantic thing.
DRM still sucks, but it's a clear improvement from a security/attack surface point of view.
Given that the CDM is sandboxed, does this mean that it should be significantly easier to recover encryption keys from it given that you could effectively run the CDM inside of a tracing emulator?
Perhaps. I don't think anyone who can think of that attack vector would really care because they'd also understand that their DRM will be broken as soon as anyone really wants the data it "protects" because it's a futile endeavor.
The encryption keys would probably be whiteboxed (http://www.whiteboxcrypto.com/) and thus you would have to break the whitebox scheme in order to recover the unprotected keys.
"""
Dan had had a classmate in software, Frank Martucci, who had obtained an illicit debugging tool, and used it to skip over the copyright monitor code when reading books. But he had told too many friends about it, and one of them turned him in to the SPA for a reward (students deep in debt were easily tempted into betrayal). In 2047, Frank was in prison, not for pirate reading, but for possessing a debugger.
""""
This seems silly. So why doesn't the attacker just rip out the whole of the decryption function from the binary instead of just the key? What's stopping an attacker from re-running that function in another program?
Today? It should be fairly easy to recover anything you want with a debugger, given sufficient time and effort.
In future versions once SGX is available (>= Intel Skylake)? Good luck extracting data from an encrypted enclave. This is, after all, the intended purpose[1] for SGX - to create the "trusted computing" (DRM) that Microsoft has wanted for the last decade[2]. It's not like these new instructions are for the end-user; Intel has to authorize[3] you binary before it can be loaded into an enclave.
Anybody using the CDM - even sandboxed - is helping to create that future. If this isn't fought and rejected now, yet another battle in the War On General Purpose Computers will be lost.
If this is true, fuck Intel. SGX had tons of promise. For example, you could run a provably secure Bitcoin mixer. Or any SaaS. MSR even published something to that effect (using SGX to run custom Hadoop jobs on their servers, without being able to see/modify your code).
Why would they gimp their platform so hard? It's not like enabling arbitrary use of SGX prevents DRM from using it.
> Intel has to authorize[3] you binary before it can be loaded into an enclave.
Wouldn't that make Intel liable for the actions of the binary? They would have to manage an application review process for any binary on any operating system, which sounds like an app store nightmare writ large. Not to mention revocation and repeating the entire process for security updates to software in the enclave. Could different governments require Intel to impose different blacklists on enclave software authors?
It's hard to see why they Intel would open themselves to such complex scenarios, unless it's a trial balloon that precedes a federated model or some other method of distributing key authority to multiple app stores and/or the hardware owner.
It has been working since Firefox 42 for me. Maybe even before then I am not sure. I guess this is just Netflix making it official now that both 32 and 64-bit versions of Firefox are officially supported on Windows?
Good eye! :) Netflix has been A/B testing the Adobe CDM in the Firefox 42 release channel for a couple weeks (and in the Firefox pre-release channels for months). This is just the official launch announcement.
Yeah I figured it was such. Thanks for all the great work on Firefox, a lot of people love to hate on it these days but it is still my favourite browser. Have a great Christmas :)
It's still a security win, because the CDM sandbox is allowed to do substantially less than the Flash sandbox. Flash can access your webcam, filesystem, make any network connection, etc. The CDM only decrypts and decodes frames.
Flash is a general-purpose virtual machine with a large attack surface, including a JIT and access to the GPU. The Adobe CDM has a tightly-controlled API. Unless Adobe's Flash updater, Firefox manages CDM updates so any CDM security fixes can be deployed to users within 24–48 hours.
I desperately hope not, my original comment sure appears to come off as rooting against Adobe, but I'll absolutely hope this means success and is the start of secured content playback on HTML5
Having spent 7.5 hours on multiple customer support calls to Adobe just to get a feature enabled (compatibility with a 32 bit system) that was stated ON THE PRODUCT BOX as being present and working... YES!
(Yes, this is a bit OT, but still, "Adobe".)
I also fear the CDM support being used to "lock down" ever more aspects of web content.
And I fear attempts on the part of Adobe as well as others (perhaps in concert with a State or corporate power) to escape sandboxing and do "whatever" on client systems for their own purposes. In other words, here is another binary blob from Adobe (et al.?) that we are supposed to trust.
Sorry, Adobe, but -- through dint of extended experience -- I simply don't trust you.
Well the DRM software has to come from somewhere and Adobe has long proven themselves to be adept at such things for the most part. Are there alternatives? Is this because of Adobe muscling out others?
I found this [1] interesting:
> Firefox does not load this module directly. Instead, we wrap it into an open-source sandbox. In our implementation, the CDM will have no access to the user’s hard drive or the network. Instead, the sandbox will provide the CDM only with communication mechanism with Firefox for receiving encrypted data and for displaying the results.
So the open-source fix for a closed-source, proprietary CDM is to sandbox it? How is this any different than Flash or Silverlight, really?
The EME-off-by-default Firefox builds are linked to from an earlier Mozilla blog post for interested users, but the builds are not linked from the main Firefox download page. These builds are technically not "EME-free" or "DRM-free", just EME off-by-default. The Adobe CDM won't be automatically downloaded or enabled.
So you'd want to make the UX more punitive for people who in the abstract don't want DRM but then go to Netflix and want it to work anyway when the choice is put in context.
Netflix isn't downloading anything and neither would any other site. The option is whether or not Firefox itself is allowed to download the Adobe CDM when it encounters a site that requires it.
That would require a Firefox build without NPAPI support. A user can't differentiate between Flash or Silverlight playing a DRM video and non-DRM video, so removing NPAPI support entirely would be the only sure method. Firefox users can disable Flash or Silverlight if they don't want sites using plugin DRM. Likewise, Firefox users can remove the Adobe CDM or uncheck the "Play DRM content" setting if they don't want sites using EME DRM.
GP didn't imply that "those stuck on Windows" make up 90% of the population or anything. But seeing how inconvenient Windows, compared to alternatives, is for the tech crowd which makes up a large portion of HN... then yes, it's fair to say "for those stuck on Windows".
> I really wonder what kind of filter bubble one must live in to write "those stuck on Windows" on a place like HN.
Aren't most users still stuck there? There is no reason to use privacy abusing, proprietary OS, unless one is really pressured by circumstances, or in more valid cases like when working on cross platform projects. That's what's called stuck.
If Netflix is useful for discovery for you[1] then use them to find stuff, and torrent and playback with a decent player. You know, one that can fix audio levels, do proper subtitles, brightness, and move position of the video.
But hey, this is a big win for Mozilla/Firefox for the general population that likes putting up with Netflix.
1: Netflix is now basically telling me my taste sucks. 9/10 items it recommends or shows it says I'll rate 1/5. My theory is they're trynna burn user time on crap, as their 4-or-5-star catalog is too small.
You would get a better selection of movies straight from Youtube if they didn't use DRM.
The studios are pushing it, and they have no interest, even disinterest, in the success of Netflix, so there's no reason for them to budge.
For Netflix, it's DRM or don't exist, with everything in between being pretty shitty (including the full DRM stance that they're at now).
I can see that you don't like DRM, but wishing a company didn't exist due to lack of compromise is just silly.
Every time I go full "anti DRM", I just think back to how everybody I knew purchased a Dreamcast, but non ever purchased a game. It's easy to have a strong stance of not supporting businesses that you don't like. It's much more difficult, as a society, to support businesses that you do like when you don't have to, especially when your demographic tends to be more towards the youth who is rarely monetarily stable and easily justifies their actions by "everyone else is doing it".
That's the lame excuse that Netflix was using. Studios (i.e. publishers) are pushing it, and Netflix (as a distributor) obliges their insanity willingly. So they bear the blame for DRM proliferation as well and can't blame it on the studios only.
> For Netflix, it's DRM or don't exist
Some sell DRM-free, and if distributors wouldn't have been so spineless about this issue, studios wouldn't have been so eager to continue this insanity.
> especially when your demographic tends to be more towards the youth who is rarely monetarily stable and easily justifies their actions by "everyone else is doing it".
Excuses of others can't justify personal choices. If you don't accept DRM - don't use it.
DRM isn't preventing any piracy and we all know that.
If Netflix was righteous, they wouldn't just DRM on their own titles, just ones that require it. Is that the case? Does Netflix use misleading words like "protect"?
Oh, nice, I recently tried netflix something like 1 month ago, and changed my mind instantly when I saw this weird message about some silverlight key DRM agreement.
Unless this is open enough to the point where I can natively browse and watch Netflix on XBMC / Kodi, this really isn't making any strides towards anything really usable. They're just shifting the tech around from one format to another without much benefit to the end user.
It's not Netflix (and other providers) that want the DRM, it's the actual movie studios. The deal is "either you use DRM from our approved whitelist or you will not be allowed to offer our shows for streaming".
In the future, all recording devices will be stream their feeds through a content approval system before being accessible for replay. Any unapproved reproductions of sounds or video captured will be replaced by approved promotional videos or ads featuring the starving children of burnt out artists, ruined by the lack of DRM.
Owning a tripod, any analog media player, and any non approved recording device, will be considered a felony, punishable by a full screen video add sent to your mandatory content approved augmented reality headset every 30 seconds to slowly pay off the lawyer fees and damages. At 0.1 cents per ad, the strongest will only survive a few hundred thousand before going completely insane.
69 comments
[ 2.9 ms ] story [ 137 ms ] threadIn Chrome? Full native binaries that are executed natively.
Such a deal.
Because Flash (and Java) are massive ongoing security concerns. Flash is too complex and has too much surface area, this new plugin even aside from being sandboxed, is simpler and with less surface area.
I am not saying that exploits won't be found here. I am just saying it may not be as bad as the continuously dripping tap that is Flash.
Not that long ago, Mozilla tried to challenge H.264 on the Web. The Chrome team agreed to drop H.264 too, but they didn't keep their word and, without a public explanation, kept supporting H.264. When cat videos encoded in H.264 don't work in Firefox but work in Chrome, users switch to Chrome and may never come back. And now when video services people pay money for work in Chrome but not Firefox, users switch to Chrome and, again, may never come back.
http://blog.chromium.org/2011/01/html-video-codec-support-in...
https://news.ycombinator.com/item?id=2093219
Ahh, hubris. They thought they could force the industry's hand with their market share... which was already starting to decline. By focusing on H.264 (and promoting Theora!), they succeeded in keeping Flash around as websites decided letting Firefox users stay with flash was easier and cheaper than listening to Mozilla's demands regarding <video>. Sometimes I hate bring right[1]...
What they should have done is dodge the problem by leaving the question of codec to the OS. Instead, Mozilla decided to drive users away. Which was also the obvious end result[2].
I understand (and support) making ideological decisions, but it's also important to pick you battles.
[1] http://yro.slashdot.org/comments.pl?sid=1597850&cid=31643970 ("Endymion"/UID=12815 on /. is me)
[2] http://yro.slashdot.org/comments.pl?sid=1597850&cid=31644218
Dodging the problem by leaving the codec support to the OS would fragment cross-platform compatibility if websites stuck with a Windows-only codec. Today, Firefox does use H.264, AAC, and MP3 decoders from the OS, but AFAIU doesn't expose any other OS codecs to web content.
Do you think the current situation with EME DRM is "H.264 all over again"? At least now, we can sandbox the DRM bits and dump NPAPI plugins. EME and CENC commoditize DRM, separating content encoding and DRM. Content providers don't need to reencode their video library to add support for new DRM systems.
No, it wouldn't have, in the long run. H.264 was chosen by the hardware manufacturers (phones, video cameras, etc), and the software world would have fallen in line. As they did.
Besides, any temporary problems could have been handled by a fix provided by not-Mozilla, just like how DVD support was enabled in many distros (by downloading libdvdcss from France).
> drop H.264
Believed the hardware industry would reverse years of designs based around H.264 is magical thinking. Software follows what the hardware supports (you are not going to get everybody to re-encode their cat videos). Anybody that believed that the browser market could trump the mobile phone market is showing they don't understand how de facto standards work. When Mozilla was arguing against H.264 5 years ago, they were already several years too late.
Screaming at the tide to turn back doesn't actually work, even if your intentions are good.
> VP8
...was future technology. Once it was actually released by Google with the WebM container it became a relevant option (which was a good idea to support in addition to H.264 that was already very commonly used.
The nonsense before Google released VP8 was merely wishful thinking. Much like how solar power advocates like to include "future improvments" in their claims, claims that H.264 was not needed usually suggested using VP8 while it was still vaporware.
> Today, Firefox does use H.264, AAC, and MP3 decoders from the OS
Which proves it is possible, and could have been done 5 years earlier to kill off Flash.
> but AFAIU doesn't expose any other OS codecs to web content.
They shouldn't, in general. Adding another list that can be probed for browser identification wold be a terrible idea.
> Do you think the current situation with EME DRM is "H.264 all over again"?
I think Mozilla is responsible for EME being completely accepted. Before announcing EME support, it was still possible to argue that EME was not supported by all browsers, an admittedly small reason for websites to not use EME. With Mozilla abandoning their mission (specifically principles #2, #6, and #7) to chase market share and become a Chrome clone, a major battle in the War On General Purpose Computing has been lost.
If Mozilla cared about the future of an open internet in the slightest, they wouldn't support any form of DRM, with no exceptions. THAT is the place a principled stand should have been taken, not video codecs. Instead, Mozilla has chosen to let others pick the battlefield. The claim was that this was necessary to safe their market share. Well, that didn't work[1].
Now that Mozilla has given up the fight against DRM, the problem will spread. The ebook industry already wants EME-like support.
[1] https://upload.wikimedia.org/wikipedia/commons/8/86/Usage_sh...
> Which proves it is possible, and could have been done 5 years earlier to kill off Flash.
How would HTML5 video, using OS codecs, kill Flash unless it also had DRM support? Flash has had DRM since 2007 (Flash Player 9).
> I think Mozilla is responsible for EME being completely accepted. Before announcing EME support, it was still possible to argue that EME was not supported by all browsers, an admittedly small reason for websites to not use EME.
Chrome shipped EME in 2013. Safari and IE shipped EME in 2014. EME content was already live and supported by ~60% of browsers when Mozilla began implementing EME in mid-2014. Perhaps Firefox could continue to lean on Flash and Silverlight to play DRM'd video.. until content providers decide they don't want to continue supporting NPAPI for Firefox's small market share. Flash is insecure and Silverlight is on the path to EOL.
> The claim was that this was necessary to safe their market share. Well, that didn't work
Whether EME has any effect on Firefox market share is yet to be seen. It just went live this week. Chrome or Edge users are unlikely to switch to Firefox because they want DRM video to stop working.
"The only winning move is not to play."
The media industries are very used to being the middlemen that dictate how their industry works. As middlemen, they have the power to control both sides (publishers and consumers). As monopolists, they get to abuse the market by tying/bundling the things people want to the things they want to push ("if you want to watch $POPULAR_SHOW, you need to submit to using our DRM"). They also get to play various financial games, though that is less important re: video.
These problems are not technical in nature, and cannot be solved by writing software. Chrome and Edge are colluding to require some type of DRM (that they or their friends control)? They should face the Sherman and Clayton Antitrust Acts. Unfortunately, we have let institutional corruption take over the parts of government that should be enforcing those laws.
Choosing freedom instead of submitting to the copyright cartels requires sacrifice. Mozilla could help this with stuff like an educational campaign, but there will always be casualties when fighting entrenched powers.
Many people chose convenience instead of investing in their future, so now we are in an uphill battle. It's difficult to convince people that they should choose a healthy browser instead of the copyright cartel's junk-food, and I don't know of any great solutions.
What I do know is that giving up the fight and granting those middlemen even more power is only going to make future battles for free software and an open internet even harder. Do you want to tackle is problem now? Or do you want let power accumulate even more and fight a harder problem in the future?
The W3C choice to standardize the mechanism for requesting DRM but not the actual system seems to be about as good as we could hope for without a magic want to get content owners to stop requiring DRM.
DRM still sucks, but it's a clear improvement from a security/attack surface point of view.
"This means that an attacker can easily ... use any kind of attack tool such as IDA Pro, debuggers, emulators, etc."
Attack tools?!
-Richard Stallman in The Right to Read http://www.gnu.org/philosophy/right-to-read.en.html
In future versions once SGX is available (>= Intel Skylake)? Good luck extracting data from an encrypted enclave. This is, after all, the intended purpose[1] for SGX - to create the "trusted computing" (DRM) that Microsoft has wanted for the last decade[2]. It's not like these new instructions are for the end-user; Intel has to authorize[3] you binary before it can be loaded into an enclave.
Anybody using the CDM - even sandboxed - is helping to create that future. If this isn't fought and rejected now, yet another battle in the War On General Purpose Computers will be lost.
[1] https://software.intel.com/en-us/blogs/2013/09/26/protecting...
[2] "Palladium" / "Next-Generation Secure Computing Base" in the early 2000s
[3] https://jbeekman.nl/blog/2015/10/intel-has-full-control-over...
Why would they gimp their platform so hard? It's not like enabling arbitrary use of SGX prevents DRM from using it.
Wouldn't that make Intel liable for the actions of the binary? They would have to manage an application review process for any binary on any operating system, which sounds like an app store nightmare writ large. Not to mention revocation and repeating the entire process for security updates to software in the enclave. Could different governments require Intel to impose different blacklists on enclave software authors?
It's hard to see why they Intel would open themselves to such complex scenarios, unless it's a trial balloon that precedes a federated model or some other method of distributing key authority to multiple app stores and/or the hardware owner.
So you mean to tell me the alternative to the buggy insanely insecure Adobe Flash is... more software by Adobe?
(Yes, this is a bit OT, but still, "Adobe".)
I also fear the CDM support being used to "lock down" ever more aspects of web content.
And I fear attempts on the part of Adobe as well as others (perhaps in concert with a State or corporate power) to escape sandboxing and do "whatever" on client systems for their own purposes. In other words, here is another binary blob from Adobe (et al.?) that we are supposed to trust.
Sorry, Adobe, but -- through dint of extended experience -- I simply don't trust you.
I found this [1] interesting:
> Firefox does not load this module directly. Instead, we wrap it into an open-source sandbox. In our implementation, the CDM will have no access to the user’s hard drive or the network. Instead, the sandbox will provide the CDM only with communication mechanism with Firefox for receiving encrypted data and for displaying the results.
So the open-source fix for a closed-source, proprietary CDM is to sandbox it? How is this any different than Flash or Silverlight, really?
[1]: https://hacks.mozilla.org/2014/05/reconciling-mozillas-missi...
http://download.cdn.mozilla.net/pub/firefox/releases/43.0/wi...
https://blog.mozilla.org/blog/2015/05/12/update-on-digital-r...
https://support.mozilla.org/en-US/kb/enable-drm
Aren't most users still stuck there? There is no reason to use privacy abusing, proprietary OS, unless one is really pressured by circumstances, or in more valid cases like when working on cross platform projects. That's what's called stuck.
When I said "Stuck on windows", I was being a little tongue-in-cheek. I'm pretty darn uninterested in platform wars.
But hey, this is a big win for Mozilla/Firefox for the general population that likes putting up with Netflix.
1: Netflix is now basically telling me my taste sucks. 9/10 items it recommends or shows it says I'll rate 1/5. My theory is they're trynna burn user time on crap, as their 4-or-5-star catalog is too small.
The studios are pushing it, and they have no interest, even disinterest, in the success of Netflix, so there's no reason for them to budge.
For Netflix, it's DRM or don't exist, with everything in between being pretty shitty (including the full DRM stance that they're at now).
I can see that you don't like DRM, but wishing a company didn't exist due to lack of compromise is just silly.
Every time I go full "anti DRM", I just think back to how everybody I knew purchased a Dreamcast, but non ever purchased a game. It's easy to have a strong stance of not supporting businesses that you don't like. It's much more difficult, as a society, to support businesses that you do like when you don't have to, especially when your demographic tends to be more towards the youth who is rarely monetarily stable and easily justifies their actions by "everyone else is doing it".
That's the lame excuse that Netflix was using. Studios (i.e. publishers) are pushing it, and Netflix (as a distributor) obliges their insanity willingly. So they bear the blame for DRM proliferation as well and can't blame it on the studios only.
> For Netflix, it's DRM or don't exist
Some sell DRM-free, and if distributors wouldn't have been so spineless about this issue, studios wouldn't have been so eager to continue this insanity.
> especially when your demographic tends to be more towards the youth who is rarely monetarily stable and easily justifies their actions by "everyone else is doing it".
Excuses of others can't justify personal choices. If you don't accept DRM - don't use it.
If Netflix was righteous, they wouldn't just DRM on their own titles, just ones that require it. Is that the case? Does Netflix use misleading words like "protect"?
As for DRM, if you can play it on a monitor, even hardware decoded, you can still capture it!
Doesn't Netflix allow you to watch the same movie over and over again without paying extra!? So there is no incentive to copy it in the first place!
Owning a tripod, any analog media player, and any non approved recording device, will be considered a felony, punishable by a full screen video add sent to your mandatory content approved augmented reality headset every 30 seconds to slowly pay off the lawyer fees and damages. At 0.1 cents per ad, the strongest will only survive a few hundred thousand before going completely insane.