Hacker News Reader

Comment by brundolf | Hacker News Reader

> If the user visits such a site, Firefox will automatically download and install such a proprietary EME/CDM module. This presented a problem to us as we would be dependent on those third-party vendors to publish ARM64 versions of those decoders.

Wait, modern browsers still download and run native binaries at the request of certain sites? How is this different from the days when native plugins like Flash were massive security liabilities? I thought we didn't do that anymore?

View on HN

As I understand it, it's a single trusted binary (Google's Widevine), not arbitrary binaries from sites, so I doubt it's a huge security liability. Not to discount all the other problems with DRM on the web, of course.

The above is correct. The CDM is very heavily sandboxed, a signature is used, and therefore it can't really do anything apart from what it's supposed to do (which is very little, taking encoded data, a key, decode media).

Source: I'm on that team, but I don't work directly on this.

This is correct. These binaries are downloaded from specific update servers.

EDIT: I stand corrected thanks to a colleague on the media team: the EME CDM update servers are known Google servers.

Worth mentioning is that this is also solving a different problem from the old browser plugin ecosystem. Rather than enabling third parties to extend browser functionality, this exists exclusively to partition the open-source Firefox codebase from closed-source DRM code, a workaround to enable DRM playback in an open-source browser.

This is correct.

I still think the "best" answer is to untick the box that says "Play DRM Content" in the Firefox preference panes, and refuse to support corporations that would otherwise use it.

I haven't bought DRM media for over fifteen years.

The site is not making any such request, it is simply using a browser feature. The browser, on demand, downloads a known and trusted binary.

I wonder if this means there will finally be a way to use things like spotify and netflix on ARM linux machines.

Reply on news.ycombinator.com