5 ms·

Translated headline: content owners can now deliver DRM'd video without using browser plugins.

by omarforgotpwd 11y ago

splike 11y ago
What else can be sent to a browser without the user being able to inspect it?
- kuschku 11y ago
  In Firefox? Not much. In Chrome? Full native binaries that are executed natively.
wmf 11y ago
There's definitely a plugin here; it's just auto-downloaded.
- mtgx 11y ago
  Great, so they told us to "embrace DRM on the web if you want plugin-free Netflix!", and then we got both the DRM and a Netflix plugin. Such a deal.
  - Someone1234 11y ago
    But why did you want plugin free Netflix to begin with? Because Flash (and Java) are massive ongoing security concerns. Flash is too complex and has too much surface area, this new plugin even aside from being sandboxed, is simpler and with less surface area. I am not saying that exploits won't be found here. I am just saying it may not be as bad as the continuously dripping tap that is Flash.
    - admax88q 11y ago
      They could easily have implemented a better more secure plugin without having to corrupt W3C standards with DRM.
      - cpeterso 11y ago
        The EME DRM specification was authored by Microsoft, Google, and Netflix. Now that the other major browsers like Chrome, Edge, IE, and Safari implement EME and it is used by major content providers like Netflix, Amazon, HBO, and Canal+, Mozilla is backed into a corner. Not that long ago, Mozilla tried to challenge H.264 on the Web. The Chrome team agreed to drop H.264 too, but they didn't keep their word and, without a public explanation, kept supporting H.264. When cat videos encoded in H.264 don't work in Firefox but work in Chrome, users switch to Chrome and may never come back. And now when video services people pay money for work in Chrome but not Firefox, users switch to Chrome and, again, may never come back. http://blog.chromium.org/2011/01/html-video-codec-support-in-chrome.html http://blog.chromium.org/2011/01/html-video-codec-support-in... https://news.ycombinator.com/item?id=2093219 https://news.ycombinator.com/item?id=2093219
        pdkl95 11y ago
        > Not that long ago, Mozilla tried to challenge H.264 on the Web. Ahh, hubris. They thought they could force the industry's hand with their market share... which was already starting to decline. By focusing on H.264 (and promoting Theora!), they succeeded in keeping Flash around as websites decided letting Firefox users stay with flash was easier and cheaper than listening to Mozilla's demands regarding <video>. Sometimes I hate bring right[1]... What they should have done is dodge the problem by leaving the question of codec to the OS. Instead, Mozilla decided to drive users away. Which was also the obvious end result[2]. I understand (and support) making ideological decisions, but it's also important to pick you battles. [1] http://yro.slashdot.org/comments.pl?sid=1597850&cid=31643970 http://yro.slashdot.org/comments.pl?sid=1597850&cid=31643970 ("Endymion"/UID=12815 on /. is me) [2] http://yro.slashdot.org/comments.pl?sid=1597850&cid=31644218 http://yro.slashdot.org/comments.pl?sid=1597850&cid=31644218
        cpeterso 11y ago
        I agree that H.264 was not a fight that could be won, considering existing H.264 content and mobile devices' hardware support. But I'm sure the situation seemed more hopeful when 40% of the browser market (30% Firefox plus 10% Chrome, at the time) would drop H.264, especially when Google also owned YouTube and On2 Technologies (VP8). Dodging the problem by leaving the codec support to the OS would fragment cross-platform compatibility if websites stuck with a Windows-only codec. Today, Firefox does use H.264, AAC, and MP3 decoders from the OS, but AFAIU doesn't expose any other OS codecs to web content. Do you think the current situation with EME DRM is "H.264 all over again"? At least now, we can sandbox the DRM bits and dump NPAPI plugins. EME and CENC commoditize DRM, separating content encoding and DRM. Content providers don't need to reencode their video library to add support for new DRM systems.
  - nnethercote 11y ago
    There are two different meanings of "plugin" being used here. The CDM plugin does just one thing (the DRM stuff) compared to, say, Flash, which is a gigantic thing. DRM still sucks, but it's a clear improvement from a security/attack surface point of view.

Translated headline: content owners can now deliver DRM'd video without using browser plugins.

splike 11y ago

What else can be sent to a browser without the user being able to inspect it?

kuschku 11y ago
In Firefox? Not much. In Chrome? Full native binaries that are executed natively.

wmf 11y ago

There's definitely a plugin here; it's just auto-downloaded.

mtgx 11y ago
Great, so they told us to "embrace DRM on the web if you want plugin-free Netflix!", and then we got both the DRM and a Netflix plugin. Such a deal.
- Someone1234 11y ago
  But why did you want plugin free Netflix to begin with? Because Flash (and Java) are massive ongoing security concerns. Flash is too complex and has too much surface area, this new plugin even aside from being sandboxed, is simpler and with less surface area. I am not saying that exploits won't be found here. I am just saying it may not be as bad as the continuously dripping tap that is Flash.
  - admax88q 11y ago
    They could easily have implemented a better more secure plugin without having to corrupt W3C standards with DRM.
    - cpeterso 11y ago
      The EME DRM specification was authored by Microsoft, Google, and Netflix. Now that the other major browsers like Chrome, Edge, IE, and Safari implement EME and it is used by major content providers like Netflix, Amazon, HBO, and Canal+, Mozilla is backed into a corner. Not that long ago, Mozilla tried to challenge H.264 on the Web. The Chrome team agreed to drop H.264 too, but they didn't keep their word and, without a public explanation, kept supporting H.264. When cat videos encoded in H.264 don't work in Firefox but work in Chrome, users switch to Chrome and may never come back. And now when video services people pay money for work in Chrome but not Firefox, users switch to Chrome and, again, may never come back. http://blog.chromium.org/2011/01/html-video-codec-support-in-chrome.html http://blog.chromium.org/2011/01/html-video-codec-support-in... https://news.ycombinator.com/item?id=2093219 https://news.ycombinator.com/item?id=2093219
      - pdkl95 11y ago
        > Not that long ago, Mozilla tried to challenge H.264 on the Web. Ahh, hubris. They thought they could force the industry's hand with their market share... which was already starting to decline. By focusing on H.264 (and promoting Theora!), they succeeded in keeping Flash around as websites decided letting Firefox users stay with flash was easier and cheaper than listening to Mozilla's demands regarding <video>. Sometimes I hate bring right[1]... What they should have done is dodge the problem by leaving the question of codec to the OS. Instead, Mozilla decided to drive users away. Which was also the obvious end result[2]. I understand (and support) making ideological decisions, but it's also important to pick you battles. [1] http://yro.slashdot.org/comments.pl?sid=1597850&cid=31643970 http://yro.slashdot.org/comments.pl?sid=1597850&cid=31643970 ("Endymion"/UID=12815 on /. is me) [2] http://yro.slashdot.org/comments.pl?sid=1597850&cid=31644218 http://yro.slashdot.org/comments.pl?sid=1597850&cid=31644218
        cpeterso 11y ago
        I agree that H.264 was not a fight that could be won, considering existing H.264 content and mobile devices' hardware support. But I'm sure the situation seemed more hopeful when 40% of the browser market (30% Firefox plus 10% Chrome, at the time) would drop H.264, especially when Google also owned YouTube and On2 Technologies (VP8). Dodging the problem by leaving the codec support to the OS would fragment cross-platform compatibility if websites stuck with a Windows-only codec. Today, Firefox does use H.264, AAC, and MP3 decoders from the OS, but AFAIU doesn't expose any other OS codecs to web content. Do you think the current situation with EME DRM is "H.264 all over again"? At least now, we can sandbox the DRM bits and dump NPAPI plugins. EME and CENC commoditize DRM, separating content encoding and DRM. Content providers don't need to reencode their video library to add support for new DRM systems.
- nnethercote 11y ago
  There are two different meanings of "plugin" being used here. The CDM plugin does just one thing (the DRM stuff) compared to, say, Flash, which is a gigantic thing. DRM still sucks, but it's a clear improvement from a security/attack surface point of view.