Xfinity Stream on Linux: A Tale of Widevine, ChromeOS, and a patched Glibc | Hacker News Reader

Xfinity Stream on Linux: A Tale of Widevine, ChromeOS, and a patched Glibc

thebrokenrail.com

144 pointsTheBrokenRail71 comments

I've had similar issues with HD not being available on Amazon Prime when I watch (certain) shows on Linux. My "fix" was rather crude: install Chrome inside wine.

A silly fix for a problem designed to get in the way of their customers. And then these companies dare to get mad at piracy.

Maybe it's because my system has wine-devel, but running Chrome or Firefox under Wine has always been really buggy for me.

It was janky as hell and definitely not usable for regular browsing, but it worked to play the single show I needed it to play so I'm content enough.

I had that working for the last year or so, for the exact same reason. But for a few weeks now my wine'd Chrome can no longer access any page, as if it can't access the network or something. Tried reinstalling it, but that didn't help either. Any ideas?

No idea, it just worked for me. Then again, I did use Lutris to get the wine env set up so maybe that's doing something to work around bugs? I basically threw the latest version of Wine staging at it. I remember having issues running the installer, but after a couple of tries it just started working.

Bah, this is genius! Any obvious gotchas? Did you try it with Netflix?

Haven't tried Netflix, that seems to do 720p (bad but watchable for cartoons and old shows) rather than the 560p I was getting from Amazon (recent live action shows).

I pirate Netflix content that I want to see in high quality, which isn't all that much to be honest. I don't really understand the point of restriction Linux when every pirate site has 4K dumps of Netflix shows mere days after launch, but I don't care enough to try to work around their restrictions when I can just wait for Sonarr to kick in.

Netflix doesn’t block HD on Linux

I guess that depends on what "HD" means. As far as I know, unless you are running a dedicated streaming device (Chromecast, Roku, etc), Windows in IE, or the Windows Netflix app, you can only watch in 720p.

You're correct, but Netflix seems to block it on the client-side. Lots of extensions fix this, and I seem to have had those installed for quite a while, so never had to think about it. Prime on the other hand, blocks it server-side, so no way to upgrade.

I'm hoping that with SteamDeck these issues get sorted, as more people use it as a docked media player.

[0]: https://addons.mozilla.org/en-US/firefox/addon/netflix-1080p...

>I'm hoping that with SteamDeck these issues get sorted, as more people use it as a docked media player.

Why won't it be the same deal as ChromeOS or Android ? It'll work with some blessed config of widewine L1, and not if you do your own thing on the device.

SteamDeck runs archlinux, so higher chance of the blessed configuration working elsewhere? Can’t really say, since Steam hasn’t elaborated on their plans yet.

Widevine L1 requires hardware backed support and keys baked into the device, which the SteamDeck does not have.

It won't be happening on the current hardware.

It's not just client side, but it's easy enough to lie to them, and the lie is very little and white

720p is literally HD: https://en.wikipedia.org/wiki/720p

Yeah but the point is that other devices get the 1080p and higher resolutions

I've never, ever used anything with a Widevine CDM in it and deliberately tell FF to not play it (and delete the binary in Chrome, or use Chromium).

Stop supporting DRM. It's normalised. It shouldn't be. I've never knowingly bought DRM'd media.

I have Firefox configured to not play DRM content unless explicitly allowed, which means it shows a permission infobar each time a site tries to use it.

The number of sites that do it without having a good reason to, likely for fingerprinting purposes, are astonishing.

What non-DRM video have you bought, if any?

I cancelled my Netflix subscription during the trial period because I'd have to install a different OS just to be actually able to watch more than 720p.

If my options are paying for 1080p and getting 720p because the company I'm paying decided to be hostile, or using an "unofficial" streaming site with a wider selection, which limits me to 720p to get me to pay for a premium version, but lets me watch the 720p for free and without hassle... I might put up with 720p but I sure as hell won't pay for it.

I skimmed the article, but one thing I didn't get is whether this is just a version difference (i.e., ChromeOS is on a different version of glibc), or is ChromeOS on a hard fork that will never reconcile with upstream ? If it's the former, it should resolve in due course; not so much for the latter.

From my understanding, neither.

It's the same code (presumably) but Chrome OS's version was compiled with metadata that said it was running on Chrome OS and Linux's version was compiled with metadata that said it was running on Linux. And that metadata is later embedded into the license request which Xfinity's servers check.

Of course, that's just my assumption from what I understand. I can't verify anything due to how obfuscated Widevine is. But due to how long-lived this problem has been, the two Widevine versions having the exact same version number (4.10.2557.0), and that everything else Widevine-wise works, I'm inclined to believe that this is intentional.

I understood that part; I meant whether running the ChromeOS widewine library on regular distributions is just a version difference in glibc, which would go away with time making the article's hack unnecessary in the future.

I see what you mean! I guess it depends on when Google updates to glibc v2.36, presumably they then would just include the DT_RELR version dependency on their binaries rather than unnecessarily patching glibc. Who knows how long that will take though since glibc v2.36 just came out a few months ago.

I seem to recall one of Netflix or Amazon Prime also claims to not be able to play UHD content on my linux machines. I've never really dug into it, as the SDR I can watch it in is fine for me.

That said, it seems odd that silliness like this still exists.

To my understanding, Widevine has two modes: L1 and L3. L3 is software protection where the browser protects against most simple reverse-engineering, but sends an unencrypted video stream to the OS' window compositor, so you can still screen record the content if you'd like. L1, on the other hand, requires a full chain of trust, meaning the encrypted video stream is sent to your GPU unit (or TV SOC), and the GPU has safeguards to prevent the OS from being able to capture that part of the screen, and most importantly has a HDCP handshake with the output device.

When a service is selecting which streams your client is granted a license to, if you claim L1 protection, the license request includes a signature from the GPU/chip doing the decryption, so the service will know whether your device only supports L3 software protection, or has a full chain of trust for the content and thus can protects against things like the user screen recording video content. Chances are the contracts rightsholders have with Netflix et al. require L1 for HD or UHD streams, and only allow L3 420p streaming (note that Netflix Originals seem to stream at 720p on L3, at least from what I've heard).

If you are really interested in scraping a copy, the HDCP keys were leaked at some point and you can buy "HDMI splitters <wink>" for ~$30 which will remove the encryption. Now trivially bypassed, and a pain in the butt for everyone else.

That was for an old version of HDCP up to 1080p, right ? Not to mention, capping and transcoding is tedious and will alter the quality. I doubt if anyone still does it as there seem to be better exploits for the determined.

There are splitters that can do 4K 60Hz HDCP 2.2. You had to really search for them because AliExpress used to remove listings that mentioned this feature explicitly. HDFury devices will do HDCP 2.3 -> 1.4 conversion (at which point you can just use a HDCP 1.4 splitter/stripper).

Due to the amount of very high quality files you have on torrenting sites, L1 is being broken already indeed, they just don't publish the methods and devices they are using for that so they don't get patched.

Yes, all the files you see on torrent sites are decrypted using L1 keys extracted from a nvidia shield using a TrustZone exploit.

> they just don't publish the methods and devices they are using for that so they don't get patched.

Well not exactly, it's hard to patch this when the keys leak from a very popular device.

Stupid question: is it also not possible to simply use VGA instead?

VGA won't create that "full chain of trust" parent is talking about. The GPU essentially says if it's outputting to an HDCP (encrypted) output and if so is expecting encrypted input. As an example if you use an HDMI -> DVI adapter or similar you'll get a scrambled-ish looking picture which is essentially you viewing the ciphertext picture.

This is pretty much inherently super lossy, so not a good bypass. You need to decrypt the actual WV stream for a good copy.

Wouldn't the only loss be from the re-encoding, which many webrips do anyways?

> Wouldn't the only loss be from the re-encoding

Which is pretty dramatic, assuming you don't want absurdly large files.

Where do you see webrips in 2022? Looking on BTN, I only see webrips for public broadcast content that literally nobody cares about. Everything else is decrypted streams (WEB-DL).

The big p2p groups with WV keys are decrypting just about everything, scene groups desperate for a reason to exist after getting utterly outdone by the p2p crowd are releasing webrips of content nobody wants.

> That said, it seems odd that silliness like this still exists.

It's only going to get worse. I don't think it's gonna take too long for corporations and governments to mandate locked down computers for everyone. Soon all software will require attestation against "tampering". Copyright industry wants this because "piracy". Banks wants this because "fraud". Messaging services want this because "terms of service". Maybe one day even ISPs will refuse to allow user controlled computers on their networks. Who knows what they could do, right? They might be a terrorist or pedophile running Tor and encrypting everything.

> All in all, this whole situation is ridiculous. It should not be this much harder to access media legally than it is to pirate.

And this is why people pirate stuff. It's just easier and more effective.

Haven't widevine keys been discovered by pirate groups but not leaked? I assumed that was how so many webrips have been released.

Google updates the Widevine CDM regularly and has an aggressive deprecation schedule. I imagine those keys have long since been replaced as a result of this. Each piece of content is encrypted with a unique key and the CDM is only used for key exchange. The leaked keys would be useless for decrypting any stored content.

Widevine L1 keys have leaked fairly regularly though and many piracy groups have private L1 keys to allow them to get clean webrips from streaming services. These keys get dumped from a vulnerable device and then don't need to be updated unless that device gets breached publically down the line.

All it takes is another vulnerable device's keybox being yanked and abused for a while until the keybox leaks further causing revocation of those Widevine keys.

They have quite a supply of keyboxes available to keep decrypting for a while.

Widevine L3 gets broken fairly often, I'd assume that's what xfinity stream on ChromeOS is using.

I guess Comcast likes to instill the idea that pirating is a better option than dealing with borked DRM mess.

I don't pirate games anymore but I still routinely pirate TV content because dealing with this nonsense is just not worth the time and effort. I'm willing to buy media. I'm not willing to be told when and where I can watch it. I buy my movies and TV on physical media, then pirate a copy to actually watch on my various devices. Far more convenient for me than bending over backwards for DRM schemes.

My Steam games, meanwhile, largely all work on Windows and Linux with no silly barriers stopping me. Just one reasonable one: login to Steam once in a while.

It's made game piracy the hassle by comparison, which is the opposite direction than that taken by current media streaming. Gabe was right when he said piracy is caused by service issues.

Yeah, DRM-free stores like GOG demonstrate that you don't need DRM to sell digital media. But movie industry is still stuck in this stupid dinosaur mentality.

> Yeah, DRM-free stores like GOG demonstrate that you don't need DRM to sell digital media. But movie industry is still stuck in this stupid dinosaur mentality.

GOG loses money, has lost money every day of it's operation, and would have gone bust long ago if it wasn't subsidised by CD Projekt.

How does it demonstrate that exactly? GOG is essentially a charity at this point, and CD Projekt has already said they are cutting costs and reducing the amount of new titles it will put on the service because that is unsustainable.

That's not due to DRM. It's due to [some] publishers not releasing more games there like on Steam. These publishers are leaving that money on the table. As soon as they put their games there, they start getting sales. So this ballistically only highlights the above point that DRM isn't needed.

GOG gets a lot of credit and it's deserved, but it's worth mentioning that the vast majority of Steam games are mostly DRM free and when they do include DRM it's at the behest of the studios. You would probably be surprised at the amount of games where you can simply right click them in your library and go to "Local files" and just see raw media laying around - JPGs, PNGS, etc.

What you are referring to is asset encryption, not DRM. Many games have DRM (e.g. Steam API and Denuvo linked into the executable) but do not encrypt their assets; it's mostly "live service" games and competitive games with matchmaking and anti-cheat that do, usually with the intent of preventing future update leaks. On the other hand it's also common for DRM-free games to use custom (usually unencrypted but possibly compressed) asset and archive formats you can't easily open, especially if they are made using an off-the-shelf engine such as Unity or Unreal.

For what it's worth, there are open source projects that will pretend to be Steam that will run many downloaded Steam games quite effectively. All you need to do is drop a few DLLs and text files in the game's folder and you're good to go. For a safe version you need to figure out how to compile the source code yourself of course but on this forum I don't expect that to be much of a barrier.

Games with DRM crapware like Denuvo and many multiplayer games are more difficult to pirate, but the basic Steam DRM is pretty useless. That's good, in a way, because when Valve inevitably goes bust these games will still be playable.

However, if you can afford to spend 15 bucks on a game, I don't see why you'd go through the effort of downloading (and virus scanning!) games. For kids and poor people I can understand spending the extra time and effort, but for people with jobs that value their free time I don't see the advantage of just paying for the game.

I suppose the lack of demos is a reason, you don't want to spend 15 bucks on a game that turns out to be boring or broken. I pirated CP2077 to check if it could run on my PC but after a few hours I paid full launch price for it, they could've convinced me with just a demo despite the negative media attention. I still remember the Just Cause 2 demo where the demo alone was a great game you could play for many hours and the full game was even better.

Most(all?) steam games have a dependency on the local steam service running, as drm goes it is fairly lightweight and easily circumvented, however it is still Digital Rights Management in my book.

DRM enablement is a hassle for the game developers too. If they can get away with it, they just don't bother.

Pretty much. Just put a fucking mp4 file with the show or a movie on my harddrive and fuck off, then I will pay for the service

Another option is to cablecut. If Comcast don't want you using their service, then don't.

YouTube TV (which is distinct from YouTube, to avoid confusion) works on basically everything.

>Another option is to cablecut. If Comcast don't want you using their service, then don't.

Comcast always tries to give you free devices, cable boxes, streaming sticks etc., even when you have just internet service from them. Aside from all these issues, there's another downside to "free cable", which is that they tack on various fees (HD fee, technology fee, etc.) even if the base price of internet + cable may seem the same as just internet. So, never get get cable.

It will be years before I have the same experience watching sports on a streaming service as on digital cable.

And for no technical reason, it's just monopolized broadcast rights to the games I want to watch.

You should really check if YouTube TV includes the channels you care about. My FIL loves sports and gets everything he wants.

I'm honestly not shilling, just... Fuck Comcast.

YouTube TV is more expensive once factoring in the premium sports and cable networks I subscribe to. And they don't even bundle internet access with it /s

> It will be years before I have the same experience watching sports on a streaming service as on digital cable

The experience watching sports on a streaming service is much better. You can see all games, you can make choices (commentary on/off) in how you see them. I watch a few different football (soccer) leagues, and by far the best experience is Ligue 1 on Amazon Prime. All the others it's a crapshoot if the broadcaster has chosen to broadcast the particular match I'm interested in, and in some cases the commentators are just painfully dumb and I'd love to be able to listen the game's noise without theirs.

The quality of Thursday night football on prime video was amazing this year. But like I said the problem isn't technical. I can't watch the games I want to watch on streaming services.

hilariously just so you know YouTube TV also uses this exact DRM technology if you were to try to screen record or screen grab while watching in Chrome

It works in Linux, though.

Comcast is literally a monopoly in the majority of the western US. You cannot cablecut if you need internet access.

And generally costs more per month than Xfinity!

xfinity TV over docsis in my area costs $111/mo ($70 TV, $28.35 Broadcast TV Fee, $13.40 Regional Sports Fee) for 125 channels (no Disney Channel) - quite a bit over the cost of YTTV at $65/mo if you can live without channels like Bloomberg Television and Gem Shopping Network. But you do get both Cartoon Network and the Disney network of channels on YTTV, when it's $20 extra on Xfinity.

People rarely factor in those fees or the HD technology fee or fee for equipment rental that most people get conned into getting.

Yeah, good to know. No Xfinity (Stream or otherwise) for me, thanks.

I thought this was 2023. Apparently Comcast didn't get the memo.

Especially odd given the entire point of Widevine is to set a content protection minimum that works cross-platform, which his machine obviously meets given it's playing video (while I had suspected xFinity would require Widevine L1/a full hardware chain for any playback, it looks like they offer a lower resolution like 720p(?) for L3 devices).

My cable box still outputs upresed 720p so I’m not too sure what they’re protecting.

I'm not sure if that's actually the case here, but it's hard to tell if the image in the article is just a sharp 480p image or 720p. It's up to the streaming service to decide the quality levels provided to L3 streams.

Reply on news.ycombinator.com