Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox’s adoption of closed-source DRM breaks my heart (2014)

theguardian.com

Post reply on HN
Print view View original

41–50 of 77 posts

Re: Firefox’s adoption of closed-source DRM breaks my heart (2014)

#41

Post by jegoodwin3 »

AnthonyMouse wrote: post #24
yohui wrote: post #21

Earlier quoted context omitted.

Even if Firefox were a monopoly, content owners would still desire DRM. Without the option to deliver that in harmony with HTML5, they'd just continue to use Flash, Silverlight, etc. We don't need counterfactuals to imagine a world without EME; we've lived it.

Flash and Silverlight were both dying before EME existed. Basically all it took was for Apple to say "no Flash" and Flash was as good as dead. I don't understand why you think that a free software infrastructure with a strong market position would be incapable of doing the same thing.

'market position' is a red herring -- it's a proxy for Developer Will. Developers care about the market share of what platform they write for, and they care about it more than principle.

You might as well say, if the developer community got its act together and stood on principle, no company could caputure 'market share' without their consent.

The problem is not the Mozilla non-profit knuckling under -- it is developers failing to have an institution similar to other professions, such as the Bar or AMA, giving them principles.

Re: Firefox’s adoption of closed-source DRM breaks my heart (2014)

#42

Post by Udo »

If this sandbox enables Firefox to safely host DRM malware, it could very well be used like a generic "Docker for the client", right? People could write high-performance code blobs in native chunks for things like online games, and Firefox would just load them without endangering the user's system or data.

Maybe someone with in-depth knowledge of the sandbox could weigh in about its actual security, I'd be interested in hearing about it.

Because if it's not secure enough to allow arbitrary code from random websites to execute safely, it's sure as hell not secure enough to run that DRM crap. What happens instead is Firefox becomes a vector for Trojan horses and root kits installable on my computer on behalf of any interest group imaginable.

I switched from Chrome to Firefox specifically for things like these.

Re: Firefox’s adoption of closed-source DRM breaks my heart (2014)

#43

Post by maxerickson »

Udo wrote: post #42

If this sandbox enables Firefox to safely host DRM malware, it could very well be used like a generic "Docker for the client", right? People could write high-performance code blobs in native chunks for things like online games, and Firefox would just load them without endangering the user's system or data. Maybe someone with in-depth knowledge of the sandbox could weigh in about its actual security, I'd be interested…

I think native code sand boxing got to browsers before docker:

https://developer.chrome.com/native-client

Re: Firefox’s adoption of closed-source DRM breaks my heart (2014)

#44

Post by johnny22 »

JupiterMoon wrote: post #22
quonn wrote: post #11

Earlier quoted context omitted.

Firefox has improved a lot, since I switched to Chrome. What I'm waiting for is proper sandboxing using a multi-process architecture (they are working on it) and rubberband scrolling. Recently, Chrome has also improved profiles a lot, and I use that to isolate Facebook. I don't think Firefox has a comparable UI for this.

Firefox profiles allow this functionality simply type "firefox -ProfileManager" into your terminal...

they were developing a standalone profile manager at one point, but it hasn't been updated in awhile.

https://developer.mozilla.org/en-US/docs/Profile_Manager

Re: Firefox’s adoption of closed-source DRM breaks my heart (2014)

#45

Post by Udo »

maxerickson wrote: post #43
Udo wrote: post #42

If this sandbox enables Firefox to safely host DRM malware, it could very well be used like a generic "Docker for the client", right? People could write high-performance code blobs in native chunks for things like online games, and Firefox would just load them without endangering the user's system or data. Maybe someone with in-depth knowledge of the sandbox could weigh in about its actual security, I'd be interested…

I think native code sand boxing got to browsers before docker: https://developer.chrome.com/native-client

That's Chrome, does Firefox have anything like this? And if it does, why do we need an extra sandbox format for the DRM stuff again?

Re: Firefox’s adoption of closed-source DRM breaks my heart (2014)

#46

Post by greggman »

AnthonyMouse wrote: post #9

There is an unintuitive takeaway from this. The reason Firefox is allowing this is that browsers and operating systems produced by nonprofits acting in the public interest don't have enough market share to resist being dictated to by for-profit corporations. Imagine FirefoxOS had the market share of Android and Debian had the market share of Windows. Would we still be having this conversation? The free software peopl…

Unfortunately Firefox has 5x the code exploit bugs vs Chrome. If we just take 2014 Firefox had 13x code exploits over Chrome.

http://www.cvedetails.com/product/15031/Google-Chrome.html?v...

http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?...

Until that number changes I'm not switching to back to Firefox.

Re: Firefox’s adoption of closed-source DRM breaks my heart (2014)

#47

Post by Caspy7 »

cpeterso wrote: post #31
azakai wrote: post #5

Earlier quoted context omitted.

Matchstick isn't a Mozilla project, is it? It happens to be built on Firefox OS code, but anyone can use that code, and Matchstick is made by a third party. Mozilla can't prevent someone from building a Firefox OS product and adding Microsoft DRM to it. So I think the "they" in your statement there might be confusing, as it seems to imply Mozilla is doing something here. (btw, I hadn't heard about this latest develop…

Matchstick is not a Mozilla project. The Matchstick company has been (deliberately?) fast and loose with its marketing around Mozilla's and content providers' brand names. http://www.matchstick.tv/about/

I've been rather irritated with the amount of sites reporting Matchstick as a Mozilla project, and again just recently. They did work with Mozilla early on to get casting running in Firefox Android to their prototype and it does have the "certified by Mozilla" label.

Hopefully their efforts on MSE and EME will help expedite development in Firefox so that Youtube doesn't suck as much.

Re: Firefox’s adoption of closed-source DRM breaks my heart (2014)

#48

Post by maxerickson »

Udo wrote: post #45
maxerickson wrote: post #43

Earlier quoted context omitted.

I think native code sand boxing got to browsers before docker: https://developer.chrome.com/native-client

That's Chrome, does Firefox have anything like this? And if it does, why do we need an extra sandbox format for the DRM stuff again?

There was a big kertuffle a few years back where Mozilla made it clear they weren't going to support anything like native client (and they then put a bunch of resources into asm.js).

I don't know if that has changed or not, I don't pay close attention. I only mentioned it because of the "Docker for the client" line, that it already exists is a pretty emphatic yes.

Re: Firefox’s adoption of closed-source DRM breaks my heart (2014)

#49

Post by greggman »

Caspy7 wrote: post #37
quonn wrote: post #11

Earlier quoted context omitted.

Firefox has improved a lot, since I switched to Chrome. What I'm waiting for is proper sandboxing using a multi-process architecture (they are working on it) and rubberband scrolling. Recently, Chrome has also improved profiles a lot, and I use that to isolate Facebook. I don't think Firefox has a comparable UI for this.

Here's an addon that allows you to sandbox sites like Facebook. https://addons.mozilla.org/en-US/firefox/addon/priv8/

That's not a sandbox by the same definition has Chrome.

Sandbox = CPU sandbox, not just cookie isolation.

To achieve that in Firefox will require massive re-writing of lots of code to basically do all the stuff Chrome was built to do. Chrome doesn't allow the CPU process running the webpage to access any OS services or hardware. All access to those are in other processes that do tons of validation that what the page is asking for it should be allowed to access. That way, even if there's a code execution bug it's unlikely to be able do any damage.

Re: Firefox’s adoption of closed-source DRM breaks my heart (2014)

#50

Post by Udo »

maxerickson wrote: post #48
Udo wrote: post #45

Earlier quoted context omitted.

That's Chrome, does Firefox have anything like this? And if it does, why do we need an extra sandbox format for the DRM stuff again?

There was a big kertuffle a few years back where Mozilla made it clear they weren't going to support anything like native client (and they then put a bunch of resources into asm.js). I don't know if that has changed or not, I don't pay close attention. I only mentioned it because of the "Docker for the client" line, that it already exists is a pretty emphatic yes.

> I only mentioned it because of the "Docker for the client" line,

You're right. I corrected the original comment to make it clearer I'm talking about Firefox. The point was to call out the sandbox argument a bit, since I'm not so sure it's actually safe to run malware in it.

Post reply on HN