News for hackers. Stuff that matters.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by emodendroket on Monday September 18, 2017 @04:44PM (#15279375)
And which browsers are going on this fork?
Re:W3C abandons consensus, standardizes DRM, EFF resigns by yellowapple on Monday September 18, 2017 @04:46PM (#15279398)
If Mozilla has any integrity, then I suspect Firefox might.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by riquito on Monday September 18, 2017 @05:09PM (#15279616)
Mozilla ended up accepting EME in 2014, because otherwise it would have become "the browser where you cannot see videos" https://hacks.mozilla.org/2014/05/reconciling-mozillas-missi...

"We have come to the point where Mozilla not implementing the W3C EME specification means that Firefox users have to switch to other browsers to watch content restricted by DRM."

Re:W3C abandons consensus, standardizes DRM, EFF resigns by wolfgke on Monday September 18, 2017 @05:12PM (#15279639)
> Mozilla ended up accepting EME in 2014, because otherwise it would have become "the browser where you cannot see videos"

Rather: "the browser where you cannot see DRM-infected video" - which is an active protection of the user against malware.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by gcp on Monday September 18, 2017 @05:49PM (#15279959)
which is an active protection of the user against malware.

You should look at how Mozilla implemented EME then. The CDM is sandboxed, in a much stricter sandbox than the rest of the browser even. So no, the CDM potentially being dangerous (for privacy or security) isn't actually that much of an issue.

Of course, someone might at some point claim that the privacy features harm the copyrights protection, at which point choices will have to be made.

History provide ample evidence that Mozilla will make the choice their users ask for (which is, by the way, not necessarily the choice some users will voice the most loudly).

Re:W3C abandons consensus, standardizes DRM, EFF resigns by untog on Monday September 18, 2017 @05:23PM (#15279727)
...and which no-one will download.

To be clear: if DRM is not implemented in browsers, Netflix and the like will just make native apps, which are far larger vectors of malware attack than the locked down EME standard is.

I'm not saying this is a good thing, but "people should just not watch DRMed video" is not an actual answer to the problem at hand.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by appleflaxen on Monday September 18, 2017 @06:12PM (#15280142)
that's the whole point: if your product is so amazing that your users will do that, then it's great! but those of us who are NOT your customers will be able to exist without the attack surface on our machine.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by wolfgke on Monday September 18, 2017 @05:26PM (#15279749)
So you claim that Firefox (and other browsers) should implement malware or a malware interface into their browser so that users don't have a reason to download and install some other malware?
Re:W3C abandons consensus, standardizes DRM, EFF resigns by pdpi on Monday September 18, 2017 @05:34PM (#15279818)
I don't know about the GP. I claim that a form of DRM that Mozilla begrudgingly accepts into Firefox has better odds of not turning out to to be "Sony Rootkit" literal malware than if everybody else is rolling their own.

This battle is lost, let's not lose the war to have our little Alamo moment.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by untog on Monday September 18, 2017 @05:30PM (#15279780)
No, I am saying that browser manufacturers should slightly increase their vulnerability surface area (and maybe not at all - I don't know the internals of EME) in order to provide a locked-down feature to users that they would only otherwise get by downloading a native app that has access to their local file system, amongst other valuable things.

It's the same logic that leads to them to support JavaScript.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by 4bpp on Monday September 18, 2017 @06:08PM (#15280119)
Assuming the motivating reasoning here is that the overarching goal of the browser vendor should be to protect the user, the question still is what timeframe it is appropriate to consider. If the browser does not implement DRM, the user may download an infected native app to watch Netflix or porn from some far shadier website or whatever, sustaining more harm in the short run; however, if the user then is repeatedly infected with malware, chances are it will not take long for a general understanding that downloadable video players are garbage-piled-up-on-grandpa's-computer bad (in the same way that IE toolbar plugins or warez websites' "special download managers" were) to take root. This will maybe chip away at the addictive convenience of Netflix and co, and so they won't be able to dictate terms to the computing ecosystem as they evidently can right now, benefiting the user in the long run.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by WorldMaker on Monday September 18, 2017 @07:37PM (#15280631)
The "garbage-piled-up-on-grandpa's-computer bad" isn't an isolated incident, and is a relatable category, as you imply in your usage, because it is a common problem. IE toolbar plugins and "special download managers" have never gone away and likely never will, those sorts of malware will continue to just change shapes. Your grandpa probably just wants to play poker with his buddies and his buddies are on Joe's Terrible Malware-Infested Poker Site. Convenience, pragmatism, and social network effect immediacy beats theory, logic, and "long term thinking".

Replace "play poker with his buddies" with "watch movies his buddies are talking about" and "Joe's Terrible Malware-Infested Poker Site" with "Netflix's DRM-Infested Site" and the results are the same every time. Your grandpa isn't likely to care if Netflix has DRM or not so long as it doesn't stop him watching movies. If Netflix, because it's the brand he and his buddies trust, tells him to install a thing to keep watching movies, he installs the thing.

Maybe, maybe you might be able to convince your grandpa to stop watching videos using that thing he installed because it's bad for his computer's health... but there are a lot of "grandpas" out there, it's a huge category of people that "I just want to do the thing and I don't care how so long as it works and is convenient".

I don't think this a question of timeframe, it's a question of do the right thing for the most users. There are a lot more "grandpas" than there are DRM-fighting or at least DRM-wary concerned citizens like you or me.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by emodendroket on Monday September 18, 2017 @07:23PM (#15280564)
> however, if the user then is repeatedly infected with malware, chances are it will not take long for a general understanding that downloadable video players are garbage-piled-up-on-grandpa's-computer bad (in the same way that IE toolbar plugins or warez websites' "special download managers" were) to take root

This is clearly written from the perspective of somebody who never did help desk work or helped family or friends with computer problems.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by 4bpp on Monday September 18, 2017 @07:32PM (#15280611)
Your point being... that I underestimate how people will keep downloading them anyway? I haven't done help desk work, but have been asked to do plenty of the latter; over the years, at least in my vicinity, skepticism about downloadable plugins had certainly developed to a level where I would only ever see the "half of the window is toolbars" IE screenshots in 4chan /g/ snark threads anymore.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by emodendroket on Monday September 18, 2017 @07:43PM (#15280650)
Yeah, that was my point... unless things have like drastically changed in the last few years I think you're overestimating the level of user education.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by zaphar on Monday September 18, 2017 @06:49PM (#15280383)
If Firefox doesn't support DRM Video Mozilla dies. Users will not use a browser where they can't watch the videos they want to watch and those videos are under DRM.

You can't solve this problem at the standard level or the browser level. You can only solve by education users enough that they see no DRM as a feature and at the legal level by enshrining user protections in law.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by ekianjo on Monday September 18, 2017 @09:11PM (#15281064)
> To be clear: if DRM is not implemented in browsers, Netflix and the like will just make native apps, which are far larger vectors of malware attack than the locked down EME standard is.

False dichotomy. Instead of exposing a small percentage of users to large attack vector (native app), you are exposing a very large percentage of users (close to 100%) with a lower attach vector. THe potential for damage is much, much higher, since it would affect about everyone using the Internet with major browsers.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by YSFEJ4SWJUVU6 on Monday September 18, 2017 @05:30PM (#15279773)
For all the DRM Netflix has pushed down our throats, they still serve many titles (mainly movies and not their own productions) in piss-poor quality with those browsers whose users' freedom they have crippled. And I do mean absolutely awful quality as some titles clock in at less than 1000 kbps which isn't even nowhere near DVD quality.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by emodendroket on Monday September 18, 2017 @05:54PM (#15280001)
What's one thing got to do with the other?
Re:W3C abandons consensus, standardizes DRM, EFF resigns by bubblethink on Monday September 18, 2017 @04:53PM (#15279458)
What good is integrity if nobody uses Firefox ? That was the main reason they added EME support in the first place. Firefox staying relevant in the browser market is a better strategy in the long run than a hard line stance against DRM.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by dTal on Monday September 18, 2017 @05:39PM (#15279869)
What good is Firefox if it doesn't have integrity?
Re:W3C abandons consensus, standardizes DRM, EFF resigns by kibwen on Monday September 18, 2017 @05:47PM (#15279940)
I can't tell if this is satire. Does anyone seriously believe that surrendering the war when you've lost one battle is an intelligent strategy? Mozilla contributes a whole lot to OSS, including providing a browser that can be trivially used without any black-box DRM-enforcement code hitting your system.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by dTal on Tuesday September 19, 2017 @12:32PM (#15286127)
I didn't mean to suggest I categorically disagreed with the decision, in this case. I simply note that you can't extend that logic indefinitely, or you lose the thing you're fighting for.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by lern_too_spel on Monday September 18, 2017 @06:42PM (#15280337)
You are free to run Firefox without the DRM module.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by thatzerodude on Monday September 18, 2017 @06:00PM (#15280060)
True that. Time to start using Firefox forks. Pale Moon, Iceweasel, GNU Icecat.

Maybe go even further outside the box, use gngr: https://gngr.info/

Re:W3C abandons consensus, standardizes DRM, EFF resigns by yellowapple on Monday September 18, 2017 @06:21PM (#15280203)
Exactly. The whole point of Firefox is to be the browser that actually protects its users. If I wanted DRM shoved down my throat, I'd be using Chrome.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by wolfgke on Monday September 18, 2017 @05:01PM (#15279536)
> What good is integrity if nobody uses Firefox ? That was the main reason they added EME support in the first place.

This was rather the point of Fall of Men ("Zeitpunkt des Sündenfalls") in Firefox' history to me. It was also the point in time where I stopped donating to them.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by sgift on Monday September 18, 2017 @05:08PM (#15279607)
And what's your solution (proposal) for the problem they faced?
Re:W3C abandons consensus, standardizes DRM, EFF resigns by wolfgke on Monday September 18, 2017 @05:10PM (#15279630)
> And what's your solution (proposal) for the problem they faced?

Make the zero-tolerance for DRM a unique selling point of Firefox.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by kibwen on Monday September 18, 2017 @05:45PM (#15279921)
Firefox is, AFAIK, the only browser vendor that decouples the EME module from the browser, allowing the browser to be downloaded without any DRM support at all. See the various "EME-free" directories here: http://download.cdn.mozilla.net/pub/firefox/releases/55.0/
Re:W3C abandons consensus, standardizes DRM, EFF resigns by hsivonen on Tuesday September 19, 2017 @05:20AM (#15282982)
The normal (not the "EME-free" ones) builds download the Widevine CDM from Google shortly after being run. The EME-free builds have a boolean pref pre-flipped, so that it doesn't download the Widevine CDM unless you manually flip the pref the other way. If you download a non-"EME-free" build and flip the pref, Firefox deletes the Widevine CDM if it already downloaded it.

In summary, if you already have Firefox, you don't need to go download a separate build to opt out of DRM. You can just uncheck the "Play DRM-controlled content" checkbox in the prefs to get to the same configuration.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by ilikepi on Monday September 18, 2017 @07:38PM (#15280636)
Interesting, I didn't realize they did this. I guess they've been doing it since EME support landed[0] in 2015, but it sounds like they opted to not really publicize it. I always just set media.eme.enabled to false when I configure a new profile, but I hadn't really considered that this does not prevent the DRM libraries from being automatically downloaded.

[0]: https://bugzilla.mozilla.org/show_bug.cgi?id=1144903

Re:W3C abandons consensus, standardizes DRM, EFF resigns by lioeters on Monday September 18, 2017 @06:38PM (#15280319)
That design decision makes sense, to decouple the EME module, and great that Mozilla offers a prebuilt binary without it, as an opt-out. I wonder if Chromium (or a fork) can also be built without this feature?
Re:W3C abandons consensus, standardizes DRM, EFF resigns by bubblethink on Monday September 18, 2017 @08:18PM (#15280826)
I'm not sure what decoupling means, and whether it's of any technical significance beyond bragging rights, but chromium won't support drm out of the box either because widevine is obviously not a part of chromium. You can take the widevine library from chrome and make it work with chromium if you jump through some hoops.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by wjoe on Tuesday September 19, 2017 @11:53AM (#15285718)
Not sure how it works on other OSs, but in my experience on Linux, Chromium is installed without Widevine DRM, Flash, or any proprietary stuff, and if you want that you have to install it separately.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by Sargos on Monday September 18, 2017 @05:38PM (#15279853)
I'm not sure "doesn't work with most major video sites" is an actual selling point.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by wolfgke on Monday September 18, 2017 @06:05PM (#15280094)
> I'm not sure "doesn't work with most major video sites" is an actual selling point.

You just have to reframe it to something like: "protects you against websites that try to plant DRM-malware on your computer".

Re:W3C abandons consensus, standardizes DRM, EFF resigns by emodendroket on Monday September 18, 2017 @07:25PM (#15280574)
"... And by the way you can't use the streaming services you pay for."
Re:W3C abandons consensus, standardizes DRM, EFF resigns by azakai on Monday September 18, 2017 @05:11PM (#15279634)
Mozilla opposed EME very strongly. But when it was clear that Google, Microsoft and Apple all supported it and were shipping it, Mozilla was forced to ship it as well (with a flag that makes it easy to disable for users that want to).
Re:W3C abandons consensus, standardizes DRM, EFF resigns by wolfgke on Monday September 18, 2017 @05:16PM (#15279675)
> Mozilla was forced to ship it as well

If anybody was forcing them, it were the media companies.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by kibwen on Monday September 18, 2017 @05:49PM (#15279956)
Google is also a media company. (Microsoft too, though Xbox isn't especially relevant here.)

EDIT: Yes, and Apple, I completely forgot about iTunes.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by emodendroket on Monday September 18, 2017 @05:54PM (#15280004)
Surely we can count Apple among media companies as well.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by AnssiH on Monday September 18, 2017 @04:58PM (#15279509)
Firefox has included support for EME DRM since 2015, despite it not being formally standardized.

I don't see them dropping it even if the HTML standard Firefox follows drops them, unless other browser vendors drop EME too.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by HappyCynic on Monday September 18, 2017 @04:53PM (#15279462)
FireFox included closed-source DRM back in 2014. They've already picked their side.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by gcp on Monday September 18, 2017 @05:53PM (#15279994)
The users picked by collectively not giving a fuck.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by zizek23 on Monday September 18, 2017 @06:27PM (#15280247)
Mozilla is playing a double game of pretending to be on the users side while completely being in Google's pocket. For Google this ensures they cannot be accused of being a monopoly.

And those working for Google attempting to divert attention to Hollywood are symptomatic of the reality distortion field and self deception of SV. Google is a spyware company engaged in mass surveillance and creepily following everyone on the planet for profit. There are no redeeming values here. SV is basically a gold rush with greed and money being the primary driver glossed over with dollops of pretension.

The world just has to step up to take control and diminish the ideology that drives SV. So far be it open source, web services, standards or regulations there is no contribution. Why are there no alternatives to Firefox, Google, Facebook and others? You can't be completely dependent on these companies and then claim victimhood.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by ubernostrum on Monday September 18, 2017 @07:00PM (#15280442)
Mozilla is not funded by Google anymore, and hasn't been for several years (the Google contract ended back when I was still working at Mozilla).

If you're interested, I wrote up some notes/thoughts from my experience in one of the sessions about EME and whether to implement it:

http://www.b-list.org/weblog/2013/oct/16/eme/

Re:W3C abandons consensus, standardizes DRM, EFF resigns by zizek23 on Monday September 18, 2017 @07:44PM (#15280657)
That deal may be over but Mozilla still gets money from Google for search. Why is user advocacy so low key and half hearted, this being just one of them. What do they have to lose?

They have consistently thrown in the towel while diluting the very things that users would choose them over Chrome for.

There are many ways to exert influence in this world. Mozilla is in SV and is very much part of the culture and ecosystem. We need genuine alternatives and activism against entrenched interests.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by gcp on Wednesday September 20, 2017 @06:15AM (#15292153)
Mozilla still gets money from Google for search.

No.

Re:W3C abandons consensus, standardizes DRM, EFF resigns by nix0n on Monday September 18, 2017 @06:44PM (#15280354)
GNU IceCat[0], which is a Firefox fork.

[0]https://directory.fsf.org/wiki/IceCat

Re:W3C abandons consensus, standardizes DRM, EFF resigns by emodendroket on Monday September 18, 2017 @07:21PM (#15280554)
There's a browser lighting up the usage charts.
Re:W3C abandons consensus, standardizes DRM, EFF resigns by frivoal on Monday September 18, 2017 @07:26PM (#15280581)
They are not a W3C member, and do not contribute to standards. So no.