Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I tried creating a web browser and Google blocked me (2019)

blog.samuelmaddock.com

Post reply on HN
Print view View original

181–190 of 194 posts

Re: I tried creating a web browser and Google blocked me (2019)

#181

Post by jcelerier »

smaddock wrote: post #39

Blog post author here. Since this post, there's now an option available for DRM-enabled Electron. However, it's only available through a single vendor, castLabs [0]. This is a closed source, downstream effort which means no modifications can be made to Electron itself. All changes must make it upstream to show up in this fork. When asked whether they would eventually merge it upstream, they didn't provide a clear ans…

> This is a closed source, downstream effort which means no modifications can be made to Electron itself.

how does that work with the fact that Blink (LGPL) is part of electron ?

Re: I tried creating a web browser and Google blocked me (2019)

#182

Post by danShumway »

eivarv wrote: post #65
smaddock wrote: post #52

Earlier quoted context omitted.

Brave also started out this way—building a browser on top of Electron. [0] Building something on top of the Chromium project is still building a browser. You're right that it's not building a rendering engine and JavaScript interpreter though. [0] https://github.com/brave/browser-laptop

... and Brave famously migrated away from building a browser using Electron, because of the security-implications (not to mention that Electron actively discourages it). Building something on top of the Chromium project is pretty different than using and embedded version of its web engine. In the case of a high-impact vulnerability, for instance, the time between committing a fix in Chromium and the user having an up…

> and Brave famously migrated away from building a browser using Electron

Is that relevant? Do you think that Google was going to refuse to license Widevine and then Brave made the migration to CEF and they said, "now we know you're serious"?

It's not user security that's causing Google to refuse to license Widevine to this project. The response Google gives is not, "I'm sorry but we're not supporting an Electron solution like this", it's "I'm sorry but we're not supporting an Open Source solution like this."

In fact, if you read the full email exchange, the suggestion that the Widevine licensing team gives is to move to a proprietary Electron fork that will be even slower to receive security patches than the upstream codebase would be. So it's definitely not the Electron/security part that Google is upset about.

Re: I tried creating a web browser and Google blocked me (2019)

#183

Post by SubiculumCode »

anthk wrote: post #154
SubiculumCode wrote: post #98

Earlier quoted context omitted.

Better have a good team of lawyers though.

IBM PC BIOS case as a previous basis.

and boy did IBM try to bring in the heavy lawyer guns on that case, didn't they.

Re: I tried creating a web browser and Google blocked me (2019)

#184

Post by kcartlidge »

Wowfunhappy wrote: post #160
kmeisthax wrote: post #79

Earlier quoted context omitted.

If Google can use this to rate limit sign-ins more effectively, then it does protect users, since the limiting factor on password security is time to crack.

I want the ability to change these types of settings for my account. They can be buried in an advanced menu somewhere. I have a password manager. My Google password is a long, unique string of random characters that I don't use on any other service. If someone does break into my Google account, it will be because they broke into my password manager and/or successfully phished me (or hit me on the head with a $5 wrenc…

Upvoted for the subtle xkcd reference :)

Re: I tried creating a web browser and Google blocked me (2019)

#185

Post by Minor49er »

MaxBarraclough wrote: post #148
Minor49er wrote: post #123

Earlier quoted context omitted.

Given the current state of the web, this might not be a bad idea

See the Gemini project, https://gemini.circumlunar.space/docs/faq.txt Somewhat related discussion: https://news.ycombinator.com/item?id=23161922

Very cool. I wasn't aware of this. Thank you!

Re: I tried creating a web browser and Google blocked me (2019)

#186

Post by eivarv »

danShumway wrote: post #182
eivarv wrote: post #65

Earlier quoted context omitted.

... and Brave famously migrated away from building a browser using Electron, because of the security-implications (not to mention that Electron actively discourages it). Building something on top of the Chromium project is pretty different than using and embedded version of its web engine. In the case of a high-impact vulnerability, for instance, the time between committing a fix in Chromium and the user having an up…

> and Brave famously migrated away from building a browser using Electron Is that relevant? Do you think that Google was going to refuse to license Widevine and then Brave made the migration to CEF and they said, "now we know you're serious"? It's not user security that's causing Google to refuse to license Widevine to this project. The response Google gives is not, "I'm sorry but we're not supporting an Electron sol…

Yes, it's relevant – they migrated from Electron because of the security-issues associated with building a browser in Electron specifically. Meaning: it's relevant because it's particularly insecure, and a bad idea to implement a browser inside a browser (which is what you do when you develop a "browser" in Electron, implementing GUI using web-technologies).

And they didn't migrate to CEF (which is another embedded framework), but built Brave on top of Chromium AFAIK.

As you can see linked [0] in another thread here, what I'm describing above makes sense in the context of Google blocking anything that's implemented in an embedded framework (e.g. Electron, CEF, webviews) which does not use browser-based OAuth authentication.

I agree – The suggestion you mention doesn't make any sense from a security perspective, but from a purely functional perspective it would seem to solve the problem at hand.

And while I agree that the end result is bad, I frankly find it weird to complain that Google won't just fork over their proprietary DRM-implementation on someone else's terms. And it's not very surprising that it's closed source, or handled this way; It's typically how DRM works, after all – which is why the inclusion of DRM in webstandards was widely debated in the first place.

[0]: https://security.googleblog.com/2019/04/better-protection-ag...

Re: I tried creating a web browser and Google blocked me (2019)

#187

Post by danShumway »

eivarv wrote: post #186
danShumway wrote: post #182

Earlier quoted context omitted.

> and Brave famously migrated away from building a browser using Electron Is that relevant? Do you think that Google was going to refuse to license Widevine and then Brave made the migration to CEF and they said, "now we know you're serious"? It's not user security that's causing Google to refuse to license Widevine to this project. The response Google gives is not, "I'm sorry but we're not supporting an Electron sol…

Yes, it's relevant – they migrated from Electron because of the security-issues associated with building a browser in Electron specifically. Meaning: it's relevant because it's particularly insecure, and a bad idea to implement a browser inside a browser (which is what you do when you develop a "browser" in Electron, implementing GUI using web-technologies). And they didn't migrate to CEF (which is another embedded f…

The Widevine team themselves suggested building the same exact system on top of a proprietary Electron fork.

> The Castlabs Electron implementation would be your only path of support. Otherwise, we don't have the resources to support at this time.

So Electron is not the reason this request was denied.

You're not wrong that Google is blocking login from embedded webviews, but the thing is that Google is separately blocking logins from embedded webviews. It's a different situation that's unrelated to their Widevine licensing. If what you were saying was correct, then the Castlabs Electron framework[0] wouldn't have Widevine support, and it does.

It's not about embedded engines, it's about Open Source.

----

> which is why the inclusion of DRM in webstandards was widely debated in the first place.

My take on this is that you would be right -- it would be weird to complain about Google refusing to set up a licensing scheme for Widevine -- if not for the fact that:

A) they were a part of the campaign for DRM inclusion in the first place, even while people argued that it would hamper browser innovation, so the problem we're in is in no small part their fault,

B) the fact that they control both Widevine licensing and the dominant desktop browser (and the fact that they have used that control to harass even mainstream browsers like Brave[1]) constitutes something at least adjacent to anticompetitive behavior,

and C) the fact that they're willing to license Widevine to Open Source browsers like Brave and Firefox suggests that there isn't a fundamental problem with Open Source that means it couldn't interact with this DRM in a way that's acceptable to Google.

Add those 3 points together, and I feel like it's reasonable to ask Google what they're doing and why they're doing it, and to expect them to have some kind of answer as to how they're going to maintain control of Widevine without cutting off the legs of browser innovation and using web standards to shut out competitors.

[0]: https://github.com/castlabs/electron-releases

[1]: https://github.com/brave/browser-laptop/issues/10449#issueco...

Re: I tried creating a web browser and Google blocked me (2019)

#188

Post by account42 »

teclordphrack2 wrote: post #93
CobrastanJorji wrote: post #55

I'm no an expert on DRM, but maybe someone here is. What would open source programs using DRM look like? My understanding is that the whole point of DRM is to prevent the software and the user from having arbitrary control over the data, which is fundamentally opposite of open source. Say that Google desperately wanted to support any reasonable method to accomplish allowing open source tools access to DRM-protected m…

DRM is just encryption. It being open source and everyone seeing what math is used is only going to make it stronger.

DRM is encryption where you give the end user all information needed to decrypt the data but still want to restrict how that decrypted data is used.

Re: I tried creating a web browser and Google blocked me (2019)

#189

Post by zucker42 »

mvolfik wrote: post #157
zucker42 wrote: post #106

Earlier quoted context omitted.

Potentially, there's a 5 year jail sentence for doing that[1]. [1] https://www.law.cornell.edu/uscode/text/17/1204

The thing is he isn't circumventing copyright protection. He is just allowing it to play in his browser too, no downloading etc. I'm a legal noob, but there always was that "fair interests" like making stuff work on different devices/OSs (youtube-dl is hiding behind this a bit), would it not apply here?

The ambiguity here is why I said potentially. Does circumventing a technical measure mean to access the content without Widevine, or is using Widevine in an unintended way enough? However, the law quite clearly says that fair use doesn't matter; you can't break DRM even if you're not violating copyright.

Re: I tried creating a web browser and Google blocked me (2019)

#190

Post by zucker42 »

avmich wrote: post #175
zucker42 wrote: post #106

Earlier quoted context omitted.

Potentially, there's a 5 year jail sentence for doing that[1]. [1] https://www.law.cornell.edu/uscode/text/17/1204

Let's rephrase: can you create a clone, a derivative work of a working OS browser, which only has DRM part not changed? I'm not sure if you're asking for technical or legal advice. If legal, then since most of us are not lawyers here, strictly speaking we can't judge if "Hello, world!" program will put us in jail or not.

Probably not, at the very least since Widevine is licensed by Google.
Post reply on HN