First, a CDM (content decryption module) is only needed for encrypted contents. This is the case for Netflix, Disney, Prime etc. but not for some other platforms like Twitch or Youtube.
How it basically work is that you have a supplementary component installed in your browser (the CDM) which is able to extract keys from special files called "licenses" and which then with that key allow to decrypt incoming encrypted content. The license itself is provided by a license server, on the internet. It is the role of the application, in JavaScript, to fetch a license and rely on specific browser API (called "EME", for "Encrypted Media Extensions") to provide that to the CDM.
Google Widevine is not the only CDM implementation. On Windows, you also now have Microsoft PlayReady on Edge+Chrome+Firefox, and you have Apple FairPlay for apple products. They are closed source.
Now they are multiple "ways" to decrypt a content, you can do all in software (in the Widevine blob) or bring hardware capabilities (like a CPU TEE or secure enclaves in general in the CPU or GPU) to ensure that people won't easily be able to extract secrets (such as keys used to encrypt licenses) from those CDM.
"VMP", for "Verified Media Path" as you wrote is a term to indicate that all components that handle decrypted media can be trusted to not leak that data to the user, it implies large hardware involvement here (everything from decryption/decoding to rendering does not leave hardware).
Yet "VMP" is not the only way to decrypt a content. Most distributors Netflix included has support for both "highly trusted pipelines" like this and less trusted ones that can only decrypt in software (still in that closed source CDM).
In CDM parlance, this is often called the "security level". Widevine has "L1" for fully hardware decrypt and decode and "L3" for software decryption, PlayReady has "SL3000" for the former and "SL2000" for the latter.
To maximize support and still please content right holders, the idea from most distributors is to "protect" higher qualities (UHD, HDR etc.) through a high security level, yet let lower qualities be decipherable even on lower security levels. And on that subject, most devices on linux don't even have access to the hardware flavor of those, I don't on mine but I would if I were on a Windows OS.
But whether there's hardware decryption (implied by VMP) or software, it is true that this is a binary blob controlled by either Google or Microsoft today, so the spirit of what you wrote still hold.
is that really so hard?
DRM is not a good thing
I think many people will rather just use the 1 thing that does everything perfectly well, rather than switch back and forth between two browsers because one is slightly better "most of the time" but also completely unusable some of the time.
For me, I am thrilled to be able to make Ladybird my main browser eventually, and consume my streaming in other apps and browsers.
If so, why would Google allow this but not for other OSS browsers?
Which is not a big deal when you are watching on a laptop screen.or via a projector.
It does, but it's L3-only (software-based), not L1 (hardware-based) [0]. Streaming providers can then decide which content they'll let you access depending on the level. Speaking from experience, some providers work perfectly (full HD content with no issues), others only give you a really low-resolution stream, and others refuse to work entirely.
> If so, why would Google allow this but not for other OSS browsers?
When EME [1] was first released, Firefox had ~10% market share, and it would look pretty bad for Google to exclude another major browser maker. Smaller browsers don't have the political clout necessary to convince Google to give them access.
[0]: https://en.wikipedia.org/wiki/Widevine#Architecture
[1]: https://en.wikipedia.org/wiki/Encrypted_Media_Extensions
Without EME, we'd still be stuck with Silverlight or ActiveX DRM in these browsers. There are browsers without Widevine that stream just fine; they use FairPlay and PlayReady instead. The current situation is still a significant improvement over the days when "free" web browsers were still a thing.
This isn't a web browser problem, it's a video streaming problem. As it turns out, the vast majority of people care more about streaming Netflix than they do about software freedom.
The minority that wants a truly open browser can buy DVDs and Blurays, or pirate the content they want to stream.
If Ladybird is willing to agree to the right terms and sign the right paperwork, I'm sure they'd get Widevine support eventually, but obviously they wouldn't be able to publish the source code for any of it.
Well, there's a niche.
Personally I have zero interest in Netflix and Spotify and I don't even know what Tidal is.
people who are not interested in these things, or can use separate systems for those things, are a viable niche for a pure-OSS distribution of Ladybird
Am I in the minority here? Do we have stats on what the breakdown of streaming traffic is by Mobile / TV / Desktop?
It's very possible it's a workaround to the streaming on PC situation though.
Also I believe a lot of households have a single TV and the rest of the household use a laptop to stream from anywhere in the house.
This is because of the lack of Widevine CDM, and the majority of people wanting to stream stuff using services like Tidal, Netflix and Spotify.
They will also want to use a single browser for everything, which in practice means Edge, Chrome, Firefox or Safari.
Ladybird will very likely not have access to Widevine, because of the cost, requirements, and Google as gatekeeper. Some developers of small opensource Chromium/Electron based browsers also earlier tried and Google simply said no.
And even if they have reverse engineered the CDM extension (which will make Widevine work, not unlike a small hack/workaround with regard to Chromium and Chromium forks) it will not work because all browsers using Widevine on those two platforms require something called VMP (Verified Media Path) which is, as far as I understand, a certificate and verification library supplied by Widevine embedded within the browser.
Without VMP embedded in the browser streaming from popular commercial providers such as Netflix will not work on Windows and MacOS, even when the Widevine extension is in fact active.
Believe me, I checked.
IMO all of this is not only set in motion to (try to) protect from piracy, but also to kill any serious competition from small parties like LadyBird, and to keep the browser market firmly in the hands of the likes of Microsoft, Apple and Google. Because who will use a browser in 2025 unable to stream content, or without hacks at 720p maximum? (looking at you, Brave and Netflix)
This also means that browsers like Brave, Vivaldi and Firefox are in fact not true opensource browsers because their respective repositories do not contain the assets needed for VMP signing.
On another note, at this moment the majority of people should be glad that browsers with corporate backing and enough income like Brave (whatever you might think of Brendan Eich's ideas), Vivaldi and Firefox exist because without them you would have no serious choice on Windows or MacOS at all.