I tried creating a web browser, and Google blocked me • Hacker News Board

Re: I tried creating a web browser, and Google blocked me

#241

Post by Natanael_L » Tue, Apr 02, 2019, 4:50 PM UTC

Townley wrote: post #225

_bxg1 wrote: post #7

DRM often results in a whitelist of media clients, killing standards in favor of a centralized authority. HDCP does the same for video feeds (HDMI, etc.). DRM-protected boxes can only output to DRM-protected displays, giving a central authority the ability to effectively deny new client devices from being made: https://en.m.wikipedia.org/wiki/High-bandwidth_Digital_Conte...

Mind helping me understand this a bit better? The link mentions that to produce a HDCP-compatible device (eg one that has an HDMI port) it needs to be licensed, pay an annual fee, and make promises to frustrate DRM-mitigation efforts. If I wanted to make my own monitor with a VGA input (or, more practically, pipe the signals coming from VGA into a program that does something with the feed) I would just have to find a…

A little bit of A and all of B/C/D. Not all of HDMI is encrypted, but for the part that is the protocol is known, but you also need the keys which are meant to be stored in secure hardware and difficult to extract.

Also, old keys are frequently phased out, with new media requiring newer keys for playback.

Re: I tried creating a web browser, and Google blocked me

#242

Post by geofft » Tue, Apr 02, 2019, 4:51 PM UTC

smaddock wrote: post #229

geofft wrote: post #172

Earlier quoted context omitted.

Did Metastream ask for a license to redistribute the binary? We don't know anything about the conversation with Widevine other than that they wrote, "I'm sorry but we're not supporting an open source solution like this". They clearly are supporting an open source solution like Firefox. So what is the difference, and can Metastream be less "like this" and more like Firefox?

I asked for a license agreement to use the Castlabs fork of Electron, which supports Widevine. https://github.com/castlabs/electron-releases

Including the same signing model as castLabs suggests, where the default release is only for UAT and you need to sign production builds (which are only generated on your infra) to decrypt production content? Or did you want to allow downstream open-source users to decrypt production content?

i.e., if they denied you, are there users of castLabs they would have allowed, and what's the distinction between you and them?

Re: I tried creating a web browser, and Google blocked me

#243

Post by verall » Tue, Apr 02, 2019, 4:54 PM UTC

Townley wrote: post #225

_bxg1 wrote: post #7

DRM often results in a whitelist of media clients, killing standards in favor of a centralized authority. HDCP does the same for video feeds (HDMI, etc.). DRM-protected boxes can only output to DRM-protected displays, giving a central authority the ability to effectively deny new client devices from being made: https://en.m.wikipedia.org/wiki/High-bandwidth_Digital_Conte...

Mind helping me understand this a bit better? The link mentions that to produce a HDCP-compatible device (eg one that has an HDMI port) it needs to be licensed, pay an annual fee, and make promises to frustrate DRM-mitigation efforts. If I wanted to make my own monitor with a VGA input (or, more practically, pipe the signals coming from VGA into a program that does something with the feed) I would just have to find a…

Most of the above, with a couple caveats.

For HDMI, specifically:

A is true, as HDMI requires a pretty ugly IP core on an fpga or an asic to process or produce the phy.

B is also true, as to sell a device with an HDMI port you have to join the group and pay fees. If you're just hacking stuff together for personal use I think you're A-okay here.

C is true ONLY in the case of HDCP protected content, as that handshake does not occur for unprotected content or HDMI 1.0

Also, side note, VGA uses analog R/G/B channels so if you want to pipe signals into the program you'd need an ADC to get useful values from it, and a pretty fast one depending on your resolution.

Re: I tried creating a web browser, and Google blocked me

#244

Post by simias » Tue, Apr 02, 2019, 4:54 PM UTC

GuB-42 wrote: post #179

mmastrac wrote: post #12

The blame for this sits squarely on the w3c for their efforts in trying to replace flash by letting the content companies dictate standards for encrypted playback. If they had held fast, we could have forced the companies to do their key management in something like WebAssembly and avoided this gatekeeping mess.

The W3C isn't to blame. No one is to blame, really. We have DRM, we hate it but it's there, and it serves a purpose. If it is your intellectual property, you get to decide how it is used. And if you don't want to make copying too easy because you think that it will get you more money, that's your right. The goal of the W3C is not to make to make a political statement about the rightness or wrongness of DRM. They are…

You make good points but:

>And if you don't want to make copying too easy because you think that it will get you more money, that's your right.

They seem to think that but is there any truth to it? I do pirate some series/movies from time to time (mostly out of convenience) and you can get high quality rips of pretty much anything mere hours after it's available on streaming sites anyway.

So what is this DRM supposed to achieve? Prevent the average non-technical user from saving the stream? I mean I'm sure they wouldn't even know where to start, there's no "Save As" button on Netflix for instance. Simple client-side limitations would do the trick for 99.9% of the population. On the other hand the few technically-savvy stream rippers seem to have no issue bypassing these protections.

DRM works better for interactive content like games because it's not just about ripping the output.

How many decades do we have to suffer through this broken scheme and this technical debt until the right owners realize that they're wasting their time and their resources to push a system that only serves to make it harder for legit clients to consume their contents?

When iTunes got rid of DRM on music files I thought it would be the tipping point where right owners would realize that this scheme was ineffective and counter-productive, but apparently it's still an industry standard for some reason. Have legit users on unsupported systems stream low-res video while the pirates can watch it in 4k for free. Ridiculous.

Re: I tried creating a web browser, and Google blocked me

#245

Post by anoncake » Tue, Apr 02, 2019, 4:56 PM UTC

tiraniddo wrote: post #92

jcranmer wrote: post #53

Earlier quoted context omitted.

Blame Google and Microsoft. They were the people who created the specification, and pushed for it, when Netflix came begging for a solution to their DRM conundrum. Even if the W3C hadn't approved it, that's two of the big four browser vendors who are committing to implementing it anyways, which is enough to guarantee a de facto standard anyways.

No, blame the movie studios, record labels etc. They're the one which require asinine DRM support for web browsers. Google/Microsoft/Apple/Adobe want to support media content, but to do so requires towing the line with the media companies otherwise they refuse to license the content (at least in HD+). Having worked with various DRM teams I know that they have to treat their code as if its the most secret code in the…

Why not blame everyone involved who let EME happen? Blame is not a limited resource.

Re: I tried creating a web browser, and Google blocked me

#246

Post by deadmik3 » Tue, Apr 02, 2019, 4:56 PM UTC

Another story to add to the long list of "don't like X? just create your own" fails thanks to the monoliths running the internet

Re: I tried creating a web browser, and Google blocked me

#247

Post by rement » Tue, Apr 02, 2019, 4:56 PM UTC

codewiz wrote: post #143

Google blocked... what? The blogpost shows the answer from Google, but crucially omits to say what exactly the author was asking for.

Widevine is the DRM component used in chromium based browsers. You need a license from them to run DRM based content in your browser. Widevine was purchased by Google in 2010

https://en.wikipedia.org/wiki/Widevine

Re: I tried creating a web browser, and Google blocked me

#248

Post by smaddock » Tue, Apr 02, 2019, 4:56 PM UTC

geofft wrote: post #242

smaddock wrote: post #229

Earlier quoted context omitted.

I asked for a license agreement to use the Castlabs fork of Electron, which supports Widevine. https://github.com/castlabs/electron-releases

Including the same signing model as castLabs suggests, where the default release is only for UAT and you need to sign production builds (which are only generated on your infra) to decrypt production content? Or did you want to allow downstream open-source users to decrypt production content? i.e., if they denied you, are there users of castLabs they would have allowed, and what's the distinction between you and them?

I'm not aware of Castlabs fork working without a production build [1]. I don't think there would be a way for open source users to be able to use a production signed release. Still waiting to hear back more from Widevine.

[1] https://github.com/castlabs/electron-releases/issues/33#issu...

Re: I tried creating a web browser, and Google blocked me

#249

Post by klyrs » Tue, Apr 02, 2019, 4:57 PM UTC

pbhjpbhj wrote: post #188

EpicEng wrote: post #74

Earlier quoted context omitted.

That's like saying the blame for pollution caused by burning coal lies squarely on the shoulders of anyone who uses electricity. Decisions are made, 99% of people have no clue what's going, and it's unreasonable to expect them to.

Consumers must take some of the blame surely? If there's nothing but coal powered electricity generation then vote to change it. If the company you buy electric from uses more coal than others, then change company. IMO ordinary members of the public take more responsibility in that because it's relatively straightforward to understand: buy your electric from renewable generation and get less negative environmental im…

No. The owners of coal mines, and the owners of coal power plants, are to blame. That specific industry has come at a terrible cost of human life and the environment, which wasn't even news last century. The people with the money and power to get a coal plant built, are to blame. I don't have choice in where I get my power. Lobbyists pay politicians to decide where my electricity is generated.

If you started cooking meth tomorrow, and sold it on the market, do you blame the users who bought it? No, the origin of the problem is the industry built around pushing the product.

Re: I tried creating a web browser, and Google blocked me

#250

Post by tomxor » Tue, Apr 02, 2019, 4:57 PM UTC

sli wrote: post #239

> ...the creators of the open source browser Chrome, ... This assumption is a mistake the author is making. Chrome is, for all practical purposes, closed-source and proprietary. It's Chromium that is open-source. So far as I know, Chromium does not have Widevine included by default.

This is correct, I use chromium - netflix and amazon do not work... the rest of the web is perfectly fine though.

It may have been a stupid decision for W£C to include DRM in the spec, but frankly the rest of the internet doesn't give a shit - As far as OSS is concerned it's another 3rd party blob like flash and not a true part of the web. As far as I can tell the author is trying to use this third party blob specifically - not the rest of the browser for which no one has any authority in the creation of...