Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reconciling Mozilla’s Mission and the W3C EME

andreasgal.com

Post reply on HN
Print view View original

81–90 of 195 posts

Re: Reconciling Mozilla’s Mission and the W3C EME

#81

Post by mike_hearn »

AnthonyMouse wrote: post #35
chimeracoder wrote: post #16

Earlier quoted context omitted.

According to Mozilla's official statement[0], it will not be open-source (it will be an open-source wrapper around the closed-source binary) There is still the question of the analog hole[1], but that's a separate matter (unrelated to open source vs. proprietary binary blob). [0] https://blog.mozilla.org/blog/2014/05/14/drm-and-the-challen... [1] https://en.wikipedia.org/wiki/Analog_hole

Nobody really uses the analog hole. It's actually easier to do it digitally, and will remain so, because securing a device against arbitrarily many attackers with physical access and arbitrarily large amounts of time and resources is a practical impossibility. The analog hole is just the formal proof that DRM can never be effective, because if you can see it or hear it you can record it.

Actually Cinavia is an interesting example of trying to close the analog hole. You can point a camcorder at your screen and record a movie, but if you try and play that recording back on a fancy TV or BluRay player, it still won't work because the audio track has encoded instructions in it saying "expect an encrypted/DRMd media stream". If the player sees the content expects to be DRMd, it silences the audio after about 20 minutes.

Re: Reconciling Mozilla’s Mission and the W3C EME

#82

Post by nileshtrivedi »

AnthonyMouse wrote: post #35
chimeracoder wrote: post #16

Earlier quoted context omitted.

According to Mozilla's official statement[0], it will not be open-source (it will be an open-source wrapper around the closed-source binary) There is still the question of the analog hole[1], but that's a separate matter (unrelated to open source vs. proprietary binary blob). [0] https://blog.mozilla.org/blog/2014/05/14/drm-and-the-challen... [1] https://en.wikipedia.org/wiki/Analog_hole

Nobody really uses the analog hole. It's actually easier to do it digitally, and will remain so, because securing a device against arbitrarily many attackers with physical access and arbitrarily large amounts of time and resources is a practical impossibility. The analog hole is just the formal proof that DRM can never be effective, because if you can see it or hear it you can record it.

I'm curious: Is it currently possible to load a proprietary OS/Browser in VirtualBox and re-direct the graphics/audio stream to a file?

Re: Reconciling Mozilla’s Mission and the W3C EME

#84

Post by shmerl »

eridius wrote: post #70
shmerl wrote: post #64

Netflix is considered the main driver behind this DRM madness. In the context of Netflix, an often voiced reason for DRM is the fact that it rents movies, rather than sells them. Besides DRM being completely ineffective to prevent piracy, the concept of rentals itself doesn't make any sense for digital goods. The core logic behind a rental (for physical goods) is reusability. Physical goods have a fixed cost of produ…

Claiming that rentals don't make sense in the digital age is focusing far too heavily on the technical fact of how digital data works, and completely ignoring the legality of things, including intellectual property. If I make a movie and sell you a DVD, the terms of the sale prohibit you from, say, showing this movie in a theater to a bunch of strangers and charging them money. Yes, you own the physical DVD, but you…

> yes, you own the physical DVD, but you don't own the intellectual property of the movie itself. This holds true for physical copies, and it holds true for digital distribution as well.

This is really irrelevant. When you buy a book you also own the book, and not the intellectual property it contains. Same thing with files - you can own the file, but not the intellectual property it represents. So legally nothing is wrong with buying digital goods (files), while the intellectual property they hold is only licensed to you (and not sold). I don't see how it correlates with any necessity for DRM.

> But in turn, they're only given access for a limited time

I don't see a need for it. Limited time of rental is justified for physical goods. For digital it's not (I explained above why).

> his again makes perfect sense, since you're paying Netflix for the right to access all of their streaming movies for the duration of your active membership. You are not paying for completely unrestricted access.

I understand Netflix terms, what I question is their sensibility. You say it makes perfect sense. I don't see any sense in limiting access. Netflix can charge the same thing for unlimited access, plus allowing making backups and still make the profit (it can add a charge per file if they worry that users would just download the whole catalog at once).

> Unfortunately, due to the nature of digital content, the only way to actually enforce these legal restrictions is by use of DRM.

No, DRM can't enforce it (since this stuff is pirated practically instantaneously). So why is it used?

Re: Reconciling Mozilla’s Mission and the W3C EME

#85

Post by nawitus »

chimeracoder wrote: post #16
nawitus wrote: post #7

>preventing users from saving the content How can an open source software prevent users from saving the content? If the CDM decrypts to plaintext, it should be trivial to modify the open source sandbox to save the plaintext data. (Obviously the software can prevent saving the content by default).

According to Mozilla's official statement[0], it will not be open-source (it will be an open-source wrapper around the closed-source binary) There is still the question of the analog hole[1], but that's a separate matter (unrelated to open source vs. proprietary binary blob). [0] https://blog.mozilla.org/blog/2014/05/14/drm-and-the-challen... [1] https://en.wikipedia.org/wiki/Analog_hole

I interpreted the open-source wrapper to be something that receives the media to be displayed in the browser (but this is just a guess).

Re: Reconciling Mozilla’s Mission and the W3C EME

#86

Post by hsivonen »

tedmielczarek wrote: post #12
stormbrew wrote: post #9

Earlier quoted context omitted.

Flash works on the three major desktop/laptop OS', ChromeOS, all the consoles afaik, and Android. EME will probably result in balkanized DRM that will never work on a bunch of those things (or you'll have to worry about whether the content you want to watch supports your platform). EME is a step down from Flash for consumer choice. A big fat one.

Flash DRM has never worked on Linux, AFAIK.

See "Linux" in https://www.adobe.com/products/adobe-access/tech-specs.html .

The problem is that copyright holders can still stipulate policies that exclude Linux. For example, http://voddler.com/en/ greets Linux users with "Here you can rent and play movies. For even more movies and TV-series, visit us from your PC or Mac, where we have a even larger selection."

Re: Reconciling Mozilla’s Mission and the W3C EME

#87

Post by makomk »

rlx0x wrote: post #26
nawitus wrote: post #7

>preventing users from saving the content How can an open source software prevent users from saving the content? If the CDM decrypts to plaintext, it should be trivial to modify the open source sandbox to save the plaintext data. (Obviously the software can prevent saving the content by default).

I guess thats pseudo DRM. On the other end you have things like RTMPe, a proprietary highly complex binary protocol that is only implemented in the adobe flash plugin binary blob. Or something like HDCP (the copy protection part of HDMI) that builds a hardware encryption platform, with an central authority and certified hardware vendors. Those are just 2 examples of "strong" DRM, but since even those two have been so…

The EME standard is explicitly designed to support hardware encryption systems that provide end-to-end encryption - think a proprietary decryption black box in your devices that takes an encrypted, compressed video screen and overlays it directly onto the screen output without it ever touching RAM anywhere where software can access it. Good luck breaking that, short of inconvenient hacks involving HDCP decryption and recompression (and those may not be long for this world either - newer video outputs are AES-encrypted).

Re: Reconciling Mozilla’s Mission and the W3C EME

#88

Post by nawitus »

AnthonyMouse wrote: post #39
JoshTriplett wrote: post #32

Earlier quoted context omitted.

Legitimate reasons to directly access the OS are typically "there isn't a browser API for this yet". We have multiple Open Source browsers now; submit a patch to one or more of them to add a new API, and ideally start working to standardize it. The result will be far better and more secure than a one-off custom plugin to pass through specific OS functionality.

If Firefox had an API that allowed you to do anything the OS allows you to do then there would be no sandbox. If it doesn't then there are things you can't do with the browser API that you could do with direct access to the OS.

But the goal is not to do everything that native applications do, but instead provide features to users. Here's an example: lets imagine it's 2005. You have a native application that stores 1 GiB of data to the disk for caching of media assets. Now you would like to reimplement that as a browser app, but there's no browser API for disk access. What's the solution? You could provide a browser API for direct arbitrary disk access, but that's clearly not secure enough. Instead, File API was created with a lot of restrictions compared to the api that the operating system has.

If you think it this way, you can go extremely far in replacing native applications. I guess the core problem is that OS APIs were not designed to execute unsafe code, but browser APIs are.

Ultimately, there's no application-level feature that couldn't be implemented with a well-designed browser API.

In addition, I like it that browsers are creating new APIs relatively slowly. The reason is simple: security is difficult, and there's time to actually think about security issues.

Re: Reconciling Mozilla’s Mission and the W3C EME

#89

Post by dblohm7 »

mlissner wrote: post #62
gcp wrote: post #58

Earlier quoted context omitted.

I really hope Mozilla manages to become financially independent of Google, whether through donations or some other revenue stream. They announced Directory Tiles a while ago, which is a step in that direction.

that plan was canceled.

That was a misinterpretation of Jonathan's blog post.

Re: Reconciling Mozilla’s Mission and the W3C EME

#90

Post by pirate_arrgh »

You know, I've long avoided the Pirate Bay for movies and other copyrighted media, and I pay monthly for month Netflix and Amazon Prime.

However, if Netflix is going to push shit like this and PMP in our faces, then I think I'm going to have to take a look at this Popcorn Time app. Particularly with PMP, it's getting to the point where it's hard for "media-compliant" Linux users to run our open source OS and legally access media at the same time.

Post reply on HN