Firefox Users Can Now Watch Netflix HTML5 Video on Windows
blog.mozilla.org
blog.mozilla.org
"This means that an attacker can easily ... use any kind of attack tool such as IDA Pro, debuggers, emulators, etc."
Attack tools?!
-Richard Stallman in The Right to Read http://www.gnu.org/philosophy/right-to-read.en.html
In future versions once SGX is available (>= Intel Skylake)? Good luck extracting data from an encrypted enclave. This is, after all, the intended purpose[1] for SGX - to create the "trusted computing" (DRM) that Microsoft has wanted for the last decade[2]. It's not like these new instructions are for the end-user; Intel has to authorize[3] you binary before it can be loaded into an enclave.
Anybody using the CDM - even sandboxed - is helping to create that future. If this isn't fought and rejected now, yet another battle in the War On General Purpose Computers will be lost.
[1] https://software.intel.com/en-us/blogs/2013/09/26/protecting...
[2] "Palladium" / "Next-Generation Secure Computing Base" in the early 2000s
[3] https://jbeekman.nl/blog/2015/10/intel-has-full-control-over...
Why would they gimp their platform so hard? It's not like enabling arbitrary use of SGX prevents DRM from using it.
Wouldn't that make Intel liable for the actions of the binary? They would have to manage an application review process for any binary on any operating system, which sounds like an app store nightmare writ large. Not to mention revocation and repeating the entire process for security updates to software in the enclave. Could different governments require Intel to impose different blacklists on enclave software authors?
It's hard to see why they Intel would open themselves to such complex scenarios, unless it's a trial balloon that precedes a federated model or some other method of distributing key authority to multiple app stores and/or the hardware owner.
In Chrome? Full native binaries that are executed natively.
Such a deal.
Because Flash (and Java) are massive ongoing security concerns. Flash is too complex and has too much surface area, this new plugin even aside from being sandboxed, is simpler and with less surface area.
I am not saying that exploits won't be found here. I am just saying it may not be as bad as the continuously dripping tap that is Flash.
Not that long ago, Mozilla tried to challenge H.264 on the Web. The Chrome team agreed to drop H.264 too, but they didn't keep their word and, without a public explanation, kept supporting H.264. When cat videos encoded in H.264 don't work in Firefox but work in Chrome, users switch to Chrome and may never come back. And now when video services people pay money for work in Chrome but not Firefox, users switch to Chrome and, again, may never come back.
http://blog.chromium.org/2011/01/html-video-codec-support-in...
Ahh, hubris. They thought they could force the industry's hand with their market share... which was already starting to decline. By focusing on H.264 (and promoting Theora!), they succeeded in keeping Flash around as websites decided letting Firefox users stay with flash was easier and cheaper than listening to Mozilla's demands regarding <video>. Sometimes I hate bring right[1]...
What they should have done is dodge the problem by leaving the question of codec to the OS. Instead, Mozilla decided to drive users away. Which was also the obvious end result[2].
I understand (and support) making ideological decisions, but it's also important to pick you battles.
[1] http://yro.slashdot.org/comments.pl?sid=1597850&cid=31643970 ("Endymion"/UID=12815 on /. is me)
[2] http://yro.slashdot.org/comments.pl?sid=1597850&cid=31644218
Dodging the problem by leaving the codec support to the OS would fragment cross-platform compatibility if websites stuck with a Windows-only codec. Today, Firefox does use H.264, AAC, and MP3 decoders from the OS, but AFAIU doesn't expose any other OS codecs to web content.
Do you think the current situation with EME DRM is "H.264 all over again"? At least now, we can sandbox the DRM bits and dump NPAPI plugins. EME and CENC commoditize DRM, separating content encoding and DRM. Content providers don't need to reencode their video library to add support for new DRM systems.
No, it wouldn't have, in the long run. H.264 was chosen by the hardware manufacturers (phones, video cameras, etc), and the software world would have fallen in line. As they did.
Besides, any temporary problems could have been handled by a fix provided by not-Mozilla, just like how DVD support was enabled in many distros (by downloading libdvdcss from France).
> drop H.264
Believed the hardware industry would reverse years of designs based around H.264 is magical thinking. Software follows what the hardware supports (you are not going to get everybody to re-encode their cat videos). Anybody that believed that the browser market could trump the mobile phone market is showing they don't understand how de facto standards work. When Mozilla was arguing against H.264 5 years ago, they were already several years too late.
Screaming at the tide to turn back doesn't actually work, even if your intentions are good.
> VP8
...was future technology. Once it was actually released by Google with the WebM container it became a relevant option (which was a good idea to support in addition to H.264 that was already very commonly used.
The nonsense before Google released VP8 was merely wishful thinking. Much like how solar power advocates like to include "future improvments" in their claims, claims that H.264 was not needed usually suggested using VP8 while it was still vaporware.
> Today, Firefox does use H.264, AAC, and MP3 decoders from the OS
Which proves it is possible, and could have been done 5 years earlier to kill off Flash.
> but AFAIU doesn't expose any other OS codecs to web content.
They shouldn't, in general. Adding another list that can be probed for browser identification wold be a terrible idea.
> Do you think the current situation with EME DRM is "H.264 all over again"?
I think Mozilla is responsible for EME being completely accepted. Before announcing EME support, it was still possible to argue that EME was not supported by all browsers, an admittedly small reason for websites to not use EME. With Mozilla abandoning their mission (specifically principles #2, #6, and #7) to chase market share and become a Chrome clone, a major battle in the War On General Purpose Computing has been lost.
If Mozilla cared about the future of an open internet in the slightest, they wouldn't support any form of DRM, with no exceptions. THAT is the place a principled stand should have been taken, not video codecs. Instead, Mozilla has chosen to let others pick the battlefield. The claim was that this was necessary to safe their market share. Well, that didn't work[1].
Now that Mozilla has given up the fight against DRM, the problem will spread. The ebook industry already wants EME-like support.
[1] https://upload.wikimedia.org/wikipedia/commons/8/86/Usage_sh...
> Which proves it is possible, and could have been done 5 years earlier to kill off Flash.
How would HTML5 video, using OS codecs, kill Flash unless it also had DRM support? Flash has had DRM since 2007 (Flash Player 9).
> I think Mozilla is responsible for EME being completely accepted. Before announcing EME support, it was still possible to argue that EME was not supported by all browsers, an admittedly small reason for websites to not use EME.
Chrome shipped EME in 2013. Safari and IE shipped EME in 2014. EME content was already live and supported by ~60% of browsers when Mozilla began implementing EME in mid-2014. Perhaps Firefox could continue to lean on Flash and Silverlight to play DRM'd video.. until content providers decide they don't want to continue supporting NPAPI for Firefox's small market share. Flash is insecure and Silverlight is on the path to EOL.
> The claim was that this was necessary to safe their market share. Well, that didn't work
Whether EME has any effect on Firefox market share is yet to be seen. It just went live this week. Chrome or Edge users are unlikely to switch to Firefox because they want DRM video to stop working.
"The only winning move is not to play."
The media industries are very used to being the middlemen that dictate how their industry works. As middlemen, they have the power to control both sides (publishers and consumers). As monopolists, they get to abuse the market by tying/bundling the things people want to the things they want to push ("if you want to watch $POPULAR_SHOW, you need to submit to using our DRM"). They also get to play various financial games, though that is less important re: video.
These problems are not technical in nature, and cannot be solved by writing software. Chrome and Edge are colluding to require some type of DRM (that they or their friends control)? They should face the Sherman and Clayton Antitrust Acts. Unfortunately, we have let institutional corruption take over the parts of government that should be enforcing those laws.
Choosing freedom instead of submitting to the copyright cartels requires sacrifice. Mozilla could help this with stuff like an educational campaign, but there will always be casualties when fighting entrenched powers.
Many people chose convenience instead of investing in their future, so now we are in an uphill battle. It's difficult to convince people that they should choose a healthy browser instead of the copyright cartel's junk-food, and I don't know of any great solutions.
What I do know is that giving up the fight and granting those middlemen even more power is only going to make future battles for free software and an open internet even harder. Do you want to tackle is problem now? Or do you want let power accumulate even more and fight a harder problem in the future?
The W3C choice to standardize the mechanism for requesting DRM but not the actual system seems to be about as good as we could hope for without a magic want to get content owners to stop requiring DRM.
DRM still sucks, but it's a clear improvement from a security/attack surface point of view.
As for DRM, if you can play it on a monitor, even hardware decoded, you can still capture it!
Doesn't Netflix allow you to watch the same movie over and over again without paying extra!? So there is no incentive to copy it in the first place!
Owning a tripod, any analog media player, and any non approved recording device, will be considered a felony, punishable by a full screen video add sent to your mandatory content approved augmented reality headset every 30 seconds to slowly pay off the lawyer fees and damages. At 0.1 cents per ad, the strongest will only survive a few hundred thousand before going completely insane.
http://download.cdn.mozilla.net/pub/firefox/releases/43.0/wi...
https://blog.mozilla.org/blog/2015/05/12/update-on-digital-r...
Aren't most users still stuck there? There is no reason to use privacy abusing, proprietary OS, unless one is really pressured by circumstances, or in more valid cases like when working on cross platform projects. That's what's called stuck.
When I said "Stuck on windows", I was being a little tongue-in-cheek. I'm pretty darn uninterested in platform wars.
But hey, this is a big win for Mozilla/Firefox for the general population that likes putting up with Netflix.
1: Netflix is now basically telling me my taste sucks. 9/10 items it recommends or shows it says I'll rate 1/5. My theory is they're trynna burn user time on crap, as their 4-or-5-star catalog is too small.
The studios are pushing it, and they have no interest, even disinterest, in the success of Netflix, so there's no reason for them to budge.
For Netflix, it's DRM or don't exist, with everything in between being pretty shitty (including the full DRM stance that they're at now).
I can see that you don't like DRM, but wishing a company didn't exist due to lack of compromise is just silly.
Every time I go full "anti DRM", I just think back to how everybody I knew purchased a Dreamcast, but non ever purchased a game. It's easy to have a strong stance of not supporting businesses that you don't like. It's much more difficult, as a society, to support businesses that you do like when you don't have to, especially when your demographic tends to be more towards the youth who is rarely monetarily stable and easily justifies their actions by "everyone else is doing it".
That's the lame excuse that Netflix was using. Studios (i.e. publishers) are pushing it, and Netflix (as a distributor) obliges their insanity willingly. So they bear the blame for DRM proliferation as well and can't blame it on the studios only.
> For Netflix, it's DRM or don't exist
Some sell DRM-free, and if distributors wouldn't have been so spineless about this issue, studios wouldn't have been so eager to continue this insanity.
> especially when your demographic tends to be more towards the youth who is rarely monetarily stable and easily justifies their actions by "everyone else is doing it".
Excuses of others can't justify personal choices. If you don't accept DRM - don't use it.
If Netflix was righteous, they wouldn't just DRM on their own titles, just ones that require it. Is that the case? Does Netflix use misleading words like "protect"?
So you mean to tell me the alternative to the buggy insanely insecure Adobe Flash is... more software by Adobe?
(Yes, this is a bit OT, but still, "Adobe".)
I also fear the CDM support being used to "lock down" ever more aspects of web content.
And I fear attempts on the part of Adobe as well as others (perhaps in concert with a State or corporate power) to escape sandboxing and do "whatever" on client systems for their own purposes. In other words, here is another binary blob from Adobe (et al.?) that we are supposed to trust.
Sorry, Adobe, but -- through dint of extended experience -- I simply don't trust you.
I found this [1] interesting:
> Firefox does not load this module directly. Instead, we wrap it into an open-source sandbox. In our implementation, the CDM will have no access to the user’s hard drive or the network. Instead, the sandbox will provide the CDM only with communication mechanism with Firefox for receiving encrypted data and for displaying the results.
So the open-source fix for a closed-source, proprietary CDM is to sandbox it? How is this any different than Flash or Silverlight, really?
[1]: https://hacks.mozilla.org/2014/05/reconciling-mozillas-missi...