Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Widevine Dump":Leaked Code Downloads HD Video from Disney+, Amazon, and Netflix

torrentfreak.com

Post reply on HN
Print view View original

61–70 of 306 posts

Re: "Widevine Dump":Leaked Code Downloads HD Video from Disney+, Amazon, and Netflix

#61

Post by hatware »

boppo1 wrote: post #32
sovietmudkipz wrote: post #10

Earlier quoted context omitted.

I don’t know why but for some reason I was hopeful to see unit tests in any of the repos. Searching “test” for that user doesn’t reveal any tests. :( Even the digital property liberators/internet pirates don’t test their software. I feel like I’m on an island with a small population of test enthusiasts.

What's the best place to get started with testing? As a newbie brogrammer it's intimidating enough writing software that works, let alone suites to comprehensively test it. Is there a testing 'bible'?

Build systems that break, the tests come naturally after that.

Re: "Widevine Dump":Leaked Code Downloads HD Video from Disney+, Amazon, and Netflix

#62

Post by datavirtue »

caillougris wrote: post #49
unbanned wrote: post #25

Earlier quoted context omitted.

>Even the digital property liberators/internet pirates don’t test their software. I feel like I’m on an island with a small population of test enthusiasts. Ultimately, what's the point. The tool either works, or it doesn't. Then you patch what doesn't work so it does work. Heck even the Linux kernel isn't tested. Unit tests are so management can have a good metric to sell code quality. I don't know any time unit test…

> I don't know any time unit testing has actually benefited shipping faster It's of huge benefits to me when I have to make a small tweak (fix a bug, or add a new specific corner case) into an existing codebase that I didn't write and don't know very well. Being able to make a small change and being confident that it will not send everything burning in hell.

This, and any code base of significant size is unknowable and starts to produce bugs naturally. Requiring tests and verifying minimum coverage are a few things you can do to control the death spiral.

I have worked on large systems devoid of tests. Not recommended. I literally witnessed multi-million dollar losses that would have been prevented by requiring tests.

Re: "Widevine Dump":Leaked Code Downloads HD Video from Disney+, Amazon, and Netflix

#63

Post by eatbitseveryday »

vmception wrote: post #17

This is one of those github repositories that you just clone and move on. Don't fork, just clone to your local system. When it gets taken down the forks will disappear, whereas the clones will not. You can also just download a zip file. https://github.com/widevinedump?tab=repositories

You can fork and detach. Then it is no longer linked.

Re: "Widevine Dump":Leaked Code Downloads HD Video from Disney+, Amazon, and Netflix

#64

Post by everybodyknows »

unbanned wrote: post #25
sovietmudkipz wrote: post #10

Earlier quoted context omitted.

I don’t know why but for some reason I was hopeful to see unit tests in any of the repos. Searching “test” for that user doesn’t reveal any tests. :( Even the digital property liberators/internet pirates don’t test their software. I feel like I’m on an island with a small population of test enthusiasts.

>Even the digital property liberators/internet pirates don’t test their software. I feel like I’m on an island with a small population of test enthusiasts. Ultimately, what's the point. The tool either works, or it doesn't. Then you patch what doesn't work so it does work. Heck even the Linux kernel isn't tested. Unit tests are so management can have a good metric to sell code quality. I don't know any time unit test…

> Heck even the Linux kernel isn't tested.

Linux kernel self-tests:

https://kselftest.wiki.kernel.org/

Kselftest is run everyday on several Linux kernel trees on the 0-Day and Linaro Test Farm and other Linux kernel integration test rings.

Most recent update to the source code was yesterday 2021-12-26:

https://patchwork.kernel.org/project/linux-kselftest/list/

Re: "Widevine Dump":Leaked Code Downloads HD Video from Disney+, Amazon, and Netflix

#65

Post by tyingq »

collegeburner wrote: post #16
peanut_worm wrote: post #12

Can’t you just record the screen or is there something preventing it?

Yes, HDCP is supposed to prevent though it is easily bypassed.

I remember seeing an article showing that many (not all) of the HDMI splitters on AliExpress just disable the HDCP with no hacking required.

Re: "Widevine Dump":Leaked Code Downloads HD Video from Disney+, Amazon, and Netflix

#67

Post by garblegarble »

londons_explore wrote: post #53
garblegarble wrote: post #27

Earlier quoted context omitted.

Ah, I thought L1 keys were burned into hardware, so blacklisting this key was effectively blacklisting a bunch of Lenovo tablets from accessing 4K HDR streaming? Edit: looks like I'm wrong about this, and the Widevine L1 keys can be changed with a firmware update. There's an interesting breakdown of how it works on Qualcomm chips here: http://bits-please.blogspot.com/2016/04/exploring-qualcomms-...

Does this mean if I have a lenovo tablet that currently streams 4K, that it will lose 4K video support? Could I ask Lenovo for a refund?

I would think so (the repo suggests this is a Lenovo TB-X505X key, I'd imagine they're at least per-product). I could certainly be be wrong about L1 keys being burned-in, that was just my understanding of it (vendor docs say things like "Hardware DRM", but maybe I'm jumping to conclusions from marketing speak)

The Widevine spec doesn't say either, it just says that all processing is within the Trusted Execution Environment, so I suppose the keys could be loaded/updated in firmware. I'm looking for more docs now...

Edit: looks like I was wrong and they can be changed with firmware updates: http://bits-please.blogspot.com/2016/04/exploring-qualcomms-...

Re: "Widevine Dump":Leaked Code Downloads HD Video from Disney+, Amazon, and Netflix

#68

Post by Scoundreller »

nikanj wrote: post #59
londons_explore wrote: post #53

Earlier quoted context omitted.

Does this mean if I have a lenovo tablet that currently streams 4K, that it will lose 4K video support? Could I ask Lenovo for a refund?

Yes and yes. Lenovo probably doesn’t give a shit, though. But you can ask!

Depends on the country. Some do have some liability on manufacturers and/or vendors for defects. Unsure if an asterisk in their click through contract about key revocation would even matter.

Re: "Widevine Dump":Leaked Code Downloads HD Video from Disney+, Amazon, and Netflix

#69

Post by jeroenhd »

londons_explore wrote: post #53
garblegarble wrote: post #27

Earlier quoted context omitted.

Ah, I thought L1 keys were burned into hardware, so blacklisting this key was effectively blacklisting a bunch of Lenovo tablets from accessing 4K HDR streaming? Edit: looks like I'm wrong about this, and the Widevine L1 keys can be changed with a firmware update. There's an interesting breakdown of how it works on Qualcomm chips here: http://bits-please.blogspot.com/2016/04/exploring-qualcomms-...

Does this mean if I have a lenovo tablet that currently streams 4K, that it will lose 4K video support? Could I ask Lenovo for a refund?

You should be able to ask Lenovo for a refund if you've bought the device with this feature in mind and if Lenovo advertised the ability to watch 4K on your preferred streaming service.

If the device just happens to support 4k, you may be out of luck. You could try sueing the parties that are supposed to deliver the 4k content and have revoked the key, but I doubt you'll get much out of them.

If you rely on DRM, the media industry has all the keys. You're left to their whims when it comes to content consumption, and there's very little you can do.

Re: "Widevine Dump":Leaked Code Downloads HD Video from Disney+, Amazon, and Netflix

#70

Post by ShamelessC »

jrm4 wrote: post #58
jrm4 wrote: post #42

Earlier quoted context omitted.

"Making an imaginary-ish copy that stays on the big Microsoft-owned system is mostly unnecessary and probably not enough to keep it around, make sure you save a copy on your own computer that they can't get to." Don't want to be (too) condescending, but, as an old-timer it's kind of wild to me that people who work with tech a lot do actually sometimes need to be reminded of this.

Okay, I know I might be breaking some kind of HN rule here, but I'm super genuinely curious as to why the downvotes here. Seriously. Is it "because people already know and I'm being condescending?" Is it "No, they shouldn't do this and instead allow the code to be censored?" Where are y'all going with this?

> Don't want to be (too) condescending

was what did it for me. basically claiming superiority prior to any actual engagement/discussion.

Post reply on HN