23 ms·

Chrome Widevine DRM can no longer be disabled

446 points by ivank 10y ago

ferbivore 10y ago
Looks like the semi-official Google position is that Widevine should have been impossible to disable all along [1]. Go figure. [1]: https://bugs.chromium.org/p/chromium/issues/detail?id=615738#c31 https://bugs.chromium.org/p/chromium/issues/detail?id=615738...
- mixedCase 10y ago
  Honestly? It makes sense and I see nothing wrong with it. Chrome is Google's opinionated version of Chromium, with the average user in mind. Everyone else should be using Chromium. There's nothing wrong or lacking in it now that the PDF module has been open sourced. If one wants Flash or Widevine, those can be installed separately.
  - mtarnovan 10y ago
    If by "everyone else" you mean 0.5% market share...
    - mixedCase 10y ago
      Well I don't know about 0.5%, but a small minority? Absolutely. Most people who interact with computers don't know how to use them. And out of the people who do know how to use it, an even smaller percentage would care about using Chromium over Chrome.
  - akjainaj 10y ago
    Is there a way to use a stable version of Chromium that automatically updates?
    - Jackneill 10y ago
      sudo pacman -S chromium. All decent distros ought to have it.
      - akjainaj 10y ago
        Thank you but I use Windows.
        deleted 10y ago
        [deleted]
        Lammy 10y ago
        It's available in Chocolatey https://chocolatey.org/packages/chromium https://chocolatey.org/packages/chromium
        ndesaulniers 10y ago
        Seeing you get downvoted for asking genuine questions to a technical community reminds me that I need to find a new one. Stack Overflow 2.0, here we come. No question now what has happened to the faces of the pigs. The creatures outside looked from pig to man, and from man to pig, and from pig to man again: but already it was impossible to say which was which.
        s_kilk 10y ago
        > decent distros
    - ferbivore 10y ago
      This page [1] has an overview of everything you need to know about using Chromium as a day-to-day browser, including a section on auto-updaters [2]. [1]: https://chromium.woolyss.com/ https://chromium.woolyss.com/ [2]: https://chromium.woolyss.com/#updater https://chromium.woolyss.com/#updater
  - drinkjuice 10y ago
    > with the average user in mind. And what average user would have a need for there being no way to disable it?
    - mixedCase 10y ago
      The average user doesn't need to nor doesn't want to know about the existence of Widevine. And if he's told about it, he wouldn't care about it, he just wants to watch Netflix.
      - devwastaken 10y ago
        Talking about use cases when it comes to widely used software is a null argument in most contexts. It was previously disablable, preventing that now is just taking features away without a benefit. Its automatically enabled for all the people that don't know about it, but need it anyway.
      - PhasmaFelis 10y ago
        You haven't answered the question. What user benefits from removing this feature? This isn't for the benefit of any user, "average" or otherwise.
        CJefferson 10y ago
        Users who don't understand it, disable it either accidentally, or based in bad advice, then don't know why Netflix doesn't work, probably in 2 years time when they long since forgot editing it. As the years go by, I learn every config option is going to lead to some set of users getting confused and upset.
        drinkjuice 10y ago
        So some parties pushing hard for DRM has nothing to do with it, whatsoever? It's all about preemptively avoiding horrible user pain and incredible customer support costs, correct? Then explain the million options left over in chrome://flags/ ? Oh, snap. Looks like that explanation doesn't even begin to make sense, and it's hilarious how the "average user", in their absence, gets used as an excuse to implement outright hostile things, but only then. When Google Reader shuts down or other things are done nobody likes, which not one person welcomes, that doesn't matter, it's only when it's about things no user wants but companies want to push when they suddenly do. The bug report mentions real problems caused by this change. Are there similar reports about problems that were caused by that option being available, or is that all just theoretical? > As the years go by, I learn every config option is going to lead to some set of users getting confused and upset. So? Remove all config options, or simply do good work and let the remaining complainers complain? Why not take the person who filed the bug report and is "confused and upset" for very good reasons they can argue for more seriously than some random hypothetical person?
  - venomsnake 10y ago
    Just tell me where in Chromium to disable resetting user profile when it detects tampering - so I am able to migrate a profile just by copying and I will move to Chromium in a second. The not being able to copy your profile between machines is terrible terrible decision. It detects "tampering" and nukes everything :(
    - mh- 10y ago
      I've not personally used this, but it should work for your use case. http://www.chromium.org/administrators/policy-list-3#RoamingProfileLocation http://www.chromium.org/administrators/policy-list-3#Roaming... (note that the 'roaming location' could still just be a folder on your local drive.) > If you enable this setting, the settings stored in Google Chrome profiles like bookmarks, autofill data, passwords, etc. will also be written to a file stored in the Roaming user profile folder or a location specified by the Administrator through the Google Chrome policy.
swiley 10y ago
Google is turning the web into things it never should have become. It's very sad.
- digi_owl 10y ago
  The other shoe is dropping?
- Silhouette 10y ago
  Sadly, I think it's popular demand that is changing the nature of the Web. Google is just taking advantage of the situation in ways that benefit themselves, as is almost everyone else in the modern Web ecosystem.
  - kijin 10y ago
    There is no such thing as popular demand, only what major web companies think will benefit their bottom line. They just supply what they want to supply and invent demand to justify it post facto. Nobody outside of the MAFIAA demanded a flickering, crashy, proprietary DRM module for the web. But since that's what Google can supply at this time, they would like all of us to pretend that there's some sort of popular demand for it. All these players add so many layers of deliberately misleading interpretation and assumptions on top of what ordinary users might actually want, it's impossible to figure out which "demands" are authentic and which ones are mere illusions anymore.
    - Silhouette 10y ago
      The popular demand isn't for DRM, it's for being able to watch movies and TV shows through online streaming instead of going out to the cinema or waiting for something to be on TV. The people making those movies and TV shows are only willing to let services put them online if those services offer certain safeguards to prevent flagrant abuse. Hence, we get DRM in online streaming systems. People who object for some reason can either disable it or use a different browser, but the price is that they don't get to stream the content. Meanwhile, most people don't know or care what DRM is or how it works, as long as they can binge-watch their favourite drama or enjoy a new movie with their family on a Saturday night.
adzm 10y ago
Is there a technical reason that this can't simply be disabled with a feature flag like many of Chrome's other features? It would avoid the whole issue. Also reading this bug report makes me realize this is probably what was going on when I had similar strange issues happen with chrome and tabs and running stuff through HDMI splitters for KVM etc.
- zeta0134 10y ago
  There isn't a technical reason it shouldn't be able to be implemented. Mostly it's a matter of getting the UI preference hooked up; it looks like they've already done something similar with the Flash plugin for users which wish to disable Flash, and this is a similar case. The reality of the Flash situation is quite messy, with a ton of websites relying on nonstandard behavior and checks to see if Flash is even installed, and Google seems to have missed the use case for disabling the plugin entirely, rather than just blocking it. This seems like a similar oversight. I'm torn here, as I see what Google is trying to accomplish with their settings spread. Mostly, the browser has chosen quite sensible defaults for the bulk of its users that needs the web to JustWork(tm) and they're hesitant to add extra checkboxes to avoid confusing folks. But with the politically charged nature of DRM, as well as the technical issues presented here (HDMI / HDCP is notoriously finnicky and the user should have more control over when it's enabled) I think a checkbox to disable the plugin entirely, similar to Flash, is the best solution.
  - paralelogram 10y ago
    Non-standard ways of embedding Flash are common because of Eolas patents: https://en.wikipedia.org/wiki/Eolas#Effects_on_other_browsers https://en.wikipedia.org/wiki/Eolas#Effects_on_other_browser... https://msdn.microsoft.com/en-us/library/ms537508.aspx https://msdn.microsoft.com/en-us/library/ms537508.aspx
shmerl 10y ago
I'm glad Mozilla provides EME-free version of Firefox: https://ftp.mozilla.org/pub/firefox/releases/51.0/ https://ftp.mozilla.org/pub/firefox/releases/51.0/
- hansjorg 10y ago
  Normal Firefox builds also provide a checkbox under the Content settings to disable it. As far as I recall, I've never touched the setting, but it's disabled here.
  - shmerl 10y ago
    I suppose EME-free builds prevent even the possibility of enabling it.
    - cpeterso 10y ago
      You can technically re-enable EME in the "EME-free" Firefox builds by setting the "media.eme.enabled" pref in about:config. The term "EME-free" is a bit of misnomer. The "EME-free" builds have two differences from regular Firefox builds: the Widevine CDM downloader is disabled and the "Play DRM content" setting checkbox is hidden.
      - shmerl 10y ago
        I see, thanks. I hoped they actually disabled EME functionality at the build time. That would have made more sense.
        kuschku 10y ago
        Well, Firefox does not contain EME functionality itself – if it’s needed, and activated, it just downloads the binary and runs it. The EME-free builds just have that download code disabled, and the setting for it hidden.
        10y ago
robxu9 10y ago
TIL that Widevine DRM is the reason my HDMI monitor flashes whenever I start or stop viewing something on Netflix or Amazon Video. Welp.
- akerro 10y ago
  Hello Firefox!
  - jasonkostempski 10y ago
    Hello Silverlight if you want Netflix too.
    - dolske 10y ago
      Firefox also includes Widevide, so Silverlight is no longer needed. Netflix works just fine with it. (https://blog.mozilla.org/futurereleases/2016/04/08/mozilla-to-test-widevine-cdm-in-firefox-nightly/ https://blog.mozilla.org/futurereleases/2016/04/08/mozilla-t...) It also includes UI to indicate when DRM content is being played, and there's a UI pref to disable DRM support entirely, if that's your thing.
  - cpeterso 10y ago
    Firefox also uses Google's Widevine CDM. I'm curious if the HDMI monitor flashes are an issue with Chrome's integration with Widevine or in Widevine itself (and thus also affecting Firefox).
    - syshum 10y ago
      Monitor Flashes because internally is basically changing inputs as it changes from unencrypted video to encrypted HDCP video
  - tedunangst 10y ago
    How does one use Firefox without widevine to watch a DRM video stream?
0x0 10y ago
This + moving SSL certificate details dialog hidden away into devtools + no way to disable NaCl + chrome 56 auto-re-enabling flash and widevine on every launch (which shows a click-to-enable-flash everywhere chrome55 would just use a html5 video player) + the upcoming background tab throttling means I'll be seriously reconsidering firefox or safari before the next Chrome release :-/
- malikNF 10y ago
  I have actually started using firefox again recently, chrome has lost me due to how hard they (and Google as a company) are trying to push things on to people. Anyways, I am in love with the nightly build of ff and everyone should honestly give it atleast a week of their time to try it. The developer edition and the nightly build have some really interesting features for development out of the box and honestly helps make work easier. You do run in to the occasional error or two but for pre-release versions they are seriously stable. p.s https://news.ycombinator.com/item?id=12579163 https://news.ycombinator.com/item?id=12579163 (Choose Firefox Now, or Later You Won't Get a Choice (2014))
  - chimeracoder 10y ago
    One thing to note - Nightly is compiled with certain debugging flags enabled, whereas Developer Edition is not. There is a slight performance hit, which is not always noticeable, but I mention it in case anybody tries Nightly and finds it slow.
    - johnp_ 10y ago
      It should be noted that some of those features can be disabled via environment variables: https://developer.mozilla.org/docs/Mozilla/Benchmarking https://developer.mozilla.org/docs/Mozilla/Benchmarking Specifically, I use those environment variables: JS_OPTION_USE_UNBOXED_ARRAYS=1 JSGC_DISABLE_POISONING=1 There's at least one other thing (async stack) that I'm aware of that may be tunable: https://bugzilla.mozilla.org/show_bug.cgi?id=1280819 https://bugzilla.mozilla.org/show_bug.cgi?id=1280819 edit: just figured out that that's "javascript.options.asyncstack", so I set it to disabled on nightly too. Fwiw, the unboxed objects bug is: https://bugzilla.mozilla.org/show_bug.cgi?id=1153266 https://bugzilla.mozilla.org/show_bug.cgi?id=1153266 edit: typedobj performance improvements visible at the bottom of https://arewefastyet.com/#machine=28&view=breakdown&suite=misc https://arewefastyet.com/#machine=28&view=breakdown&suite=mi... edit: removed MOZ_QUIET=1, as a source inspection reveals that it is only compiled #ifdef DEBUG.
nmjohn 10y ago
What a frustrating change. However it still is possible to disable (though you probably will need to do this every time chrome updates) Simply deleting the folder that contains "widevinecdmadapter.plugin" will effectively disable the plugin. So, for example, on OSX using homebrew to install chrome, it'd be: rm -rf /opt/homebrew-cask/Caskroom/google-chrome-canary/latest/Google\ Chrome\ Canary.app/Contents/Versions/58.0.2996.0/Google\ Chrome\ Framework.framework/Libraries/WidevineCdm
- deleted 10y ago
  [deleted]
- Sunset 10y ago
  You can deny write permissions to the folder.
  - mschuster91 10y ago
    I wouldn't try that as it will likely break the auto-updater when it tries to update the Widevine files.
    - jaimex2 10y ago
      try it, then revert if it does break.
    - Sunset 10y ago
      Is there something like an "overlay" FUSE fs which pretend to write what you give it but then just discards what you give it and returns the actual file when you attempt to read? To defeat checks right after writes it could return what you wrote once( or a configurable number of times) but after that just give you the original file when you read it.
mtarnovan 10y ago
This might be the straw that finally pushed me to switch to some other browser. Any thoughts on Chromium vs Firefox?
- joecool1029 10y ago
  Edge is getting there! Surprised that this is the straw and it wasn't the hotwording binary that was pulled in to listen for "ok, google" without anyone's knowledge or permission.
  - Buge 10y ago
    Is it possible to disable DRM in Edge? Did that binary ever listen to anything? And as far as I know, the hotwording binary outrage was about Chromium, not about Chrome.
  - arkades 10y ago
    I'd be OK with Edge except that in Win10, Edge gets subsumed into "System" in the volume mixer. You can't lower the volume on the Edge program, like you can on Firefox, Chrome, or on previous versions of IE. In short, when ads or background music start blasting, you can either mute your entire system, or you're stuck with them - can't mute Edge specifically. That's a killer feature right there.
  - ocdtrekkie 10y ago
    Edge is getting pretty good, it's UI performance is as good or better than Chrome now. BUT, if you're leaving Chrome because they include proprietary binaries, moving to Edge isn't an improvement there.
- problems 10y ago
  It's really a question of whether flexibility or UI performance is a higher priority for you. If you want incredible customization options, go to Firefox. If you want Chrome's UI performance, stick to Chromium.
- edoceo 10y ago
  Check out Vivaldi and Blisk as well
bostand 10y ago
I don't mind paying for content. In fact, I pay a lot for my content consumption as direct purchases and streaming services. But I don't like having a huge pile of unverified third party code in a browser i never use for content consumption.
- asadotzler 10y ago
  The CDM is a lot less of a huge pile of unverified third party code in the browser than was Flash and Silverlight before.
timonovici 10y ago
I currently use Firefox with JS disabled, for casual browsing, and Min for anything with video or JS https://minbrowser.github.io/min/ https://minbrowser.github.io/min/ - finally, after years, I can use a system with less than 8G of RAM. This browser is based on Electron - does Electron also bundle this abomination of DRM plugin?
- Zardoz84 10y ago
  If you disabled JS, why you not use something far more lightweight, like ELinks ?
  - timonovici 10y ago
    I need images, tabs, tabgroups. The developer tools are nice to have. And I'm just used to it. It sits just below 500M of RAM, with about a hundred tabs. I can deal with that.
- goodplay 10y ago
  I use linux's control groups with very satisfactory results.
  - bcook 10y ago
    In what way do you use them?
    - goodplay 10y ago
      I designate a separate memory control group for the browser, and set both `memory.limit_in_bytes` and `memory.memsw.limit_in_bytes` to 1.5 GB. Then the browser is launched within that group. The tools are the standard cgcreate and cgexec. When the browser depletes all its memory allowance, I use killall to kill the tab processes leaving only the chrome running. I refresh the tab I want and carry on. Might seem convoluted, but works extremely well in practice. edit: It should be noted that I currently use chromium. I intend to switch to firefox as soon as I can port this workflow to it or otherwise achieve a similar result.
murkle 10y ago
This is a useful link from there: chrome://flags/#prefer-html-over-flash
imode 10y ago
so, it's kind of worrying. I hope this kind of change won't be common among browsers. I'd rather a killswitch and a moment of "ah crap, I have to enable that" than a slew of third-party code enabled at all times. no thanks.
- angryasian 10y ago
  that's not how widevine works
wslh 10y ago
We are all that boiling frog [1]. Google, and others, introduced a new business tactic that is even been followed by Microsoft (in reverse mode). They push all kind of open source and free stuff and slowly, very slowly, they move to old monopolies tactics. Most locked people will not change to another browser just because they added a new "tiny" portion of code which is not political correct. [1] https://en.wikipedia.org/wiki/Boiling_frog https://en.wikipedia.org/wiki/Boiling_frog
- superkuh 10y ago
  Yep. And if you don't like it they (Google/Mozilla) tell you to use the developer's version. As if using an alpha was an acceptable option.
  - Vinnl 10y ago
    Why include Mozilla in those parentheses?
    - mort96 10y ago
      Firefox' non-developer version is also getting more locked down. I had to change to it from the regular version when I couldn't use the extension I have written for myself anymore, because Mozilla removed the option to install unsigned extensions.
PostThisTooFast 10y ago
More Google hypocrisy.
PostThisTooFast 10y ago
More Google hypocrisy.
angryasian 10y ago
Sorry but can someone explain the problem. I'm very familiar with widevine, hls / hlse, and other various DRM type solutions. To me it appears a lot of uninformed answers or something that's completely blown out of proportion. So looking for someone to explain ?
- jnky 10y ago
  What do you want to know about the problem? I wrote the bug report that this thread is about. I think my reasons for arguing there should be a way to disable Widevine are very clear. To sum it up again: - Widevine DRM has usability issues (mostly because of HDCP) ad well as stability issues, as outlined in the bug report. - I am politically opposed to HTML EME and I don't want it enabled in my browser. I would like it better if it was unavailable to begin with. - From a security perspective, allowing every web site that I allow Javascript on to talk to some dubious blob behind my back is the last thing I want.
deleted 10y ago
[deleted]
raldi 10y ago
Can someone explain this in a way that assumes no prior knowledge of Widevine or EME?
- josteink 10y ago
  It's HTML DRM. Most technical people are vocally opposed to it and don't want to leave a single trace in a single server log contributing to the idea that it is widely accepted and available. A browser not only implementing DRM, but leaving you no way to disable it is seriously anti-user. But this is Google, so go figure.
  - raldi 10y ago
    So I know what HTML is, and I know what DRM is, but I don't understand what you mean by "HTML DRM". And googling [widevine] is not helping.
    - josteink 10y ago
      HTML has always been an open standard. Every part has been open. Just by reading the spec, you could implement a fully functional web-browser. There were no secrets bits or black boxes. So people went ahead did just that. They made new and exciting web-browsers, with new and novel features, on lots and lots of platforms. And that's why the web was a success: It was open to use by people. It was open for new clients. Nothing was locked down. With DRM in the HTML spec comes a big, black box: You can no longer implement a fully compliant web browser from the spec alone. You'll need closed-source blobs from DRM vendors, if they are willing to provide them to you, and if they bother about compatibility with your browser, your OS, not to mention your HW architecture. The web used to be 100% open and 100% cross-platform. The single move of adding DRM instead makes it a platform which now will only be 100% "compliant" in browsers blessed by DRM vendors, on OSes blessed by DRM vendors, on HW architectures which the DRM-vendors has bothered to implement DRM for. It's a complete turn-around. A 100% FOSS web-browser can no longer be made. It basically has put the 3 top DRM-vendors (Apple, Google, MS) in 100% control of which people, and on which operating systems, can get to have a full web experience. I guess I don't need to argue why this is bad. You can take it from here, right?
BrendanEich 10y ago
That's interesting, because Brave has Widevine off by default and includes this notice in the preference UX for enabling it: --- Google Widevine Support Google Widevine is a piece of Digital Rights Management (DRM) code that we at Brave Software do not own and cannot inspect. The Google Widevine code is loaded from Google servers, not from our servers. It is loaded only when you enable this option. We discourage the use of DRM, but we respect user choice and acknowledge that some Brave users would like to use services that require it. [info link to https://www.eff.org/issues/drm https://www.eff.org/issues/drm] By installing this extension, you are agreeing to the Google Widevine Terms of Use. You agree that Brave is not responsible for any damages or losses in connection with your use of Google Widevine. [info link to https://www.google.com/policies/terms/ https://www.google.com/policies/terms/] Enable Google Widevine support [button label] --- You can view this as a DRM mandate canary if you like. It's still in Brave 0.13.0. That's all I have to say for now.
- BrendanEich 10y ago
  We don't even load the DRM module (CDM) until that pref is enabled, note well.
bartvk 10y ago
I've moved to Firefox on my MacBook. To make it a bit more macOS-like, there's two nice plugins: https://addons.mozilla.org/en-US/firefox/addon/pinch-to-zoom-firefox-osx/ https://addons.mozilla.org/en-US/firefox/addon/pinch-to-zoom... for pinch-to-zoom https://addons.mozilla.org/en-US/firefox/addon/compact-theme/ https://addons.mozilla.org/en-US/firefox/addon/compact-theme... for a theme that makes it look more Safari-like
baybal2 10y ago
Oh, thats why my hdmi splitter goes down every time on vimeo
neurobot 10y ago
i switch from Firefox only if i want to watch video on non-HTML5 website.
rabboRubble 10y ago
Funny enough in Firefox Widevine was default set to Always Activate on my machine. Not sure how long it's been that way. There was no "ask to activate" option. I was however able to set to "never activate". Let's see how long before this becomes annoying.
- jnky 10y ago
  Surfing with Widevine disabled is no problem at all. Netflix and Amazon Prime Video do not work, though.
  - rabboRubble 10y ago
    thanks... thinking about this more, I don't even recall installing Widevine at any point in the past. Perhaps bundled with FF? Fortunately, I never stream Netflix / AP to my computers.
Fej 10y ago
You know what they say - switch to Firefox now, or you won't have a choice later.
- BrendanEich 10y ago
  Robert O'Callahan said that, but then he left. I wish he had not said it, and so do many other heavy hitters who are or were at Mozilla. It makes Firefox sound like a pity-f$#k, or a sin tax. At worst, a feel-good gesture that has unintended consequences. If you like Firefox, use it! If you like Brave, either for the speed and safety of our 3rd party ad/tracker blocking that's on by default; or for the post-browser, user-data-sovereignty economics we're building to sustain; then use Brave. If you like Vivaldi, use it. And so on. But don't make a cult out of one particular browser. Open source is not an issue. FYI, Brave is all open source.
  - anonlineperson 10y ago
    Just please don't use IE unless its unavoidable
goslackware 10y ago
It appears that DRM in Chrome might be disabled by disabling the "WidevineCDM" (binary) component update via group policy: https://bugs.chromium.org/p/chromium/issues/detail?id=624128 https://bugs.chromium.org/p/chromium/issues/detail?id=624128
- jnky 10y ago
  I don't think that works. As per https://bugs.chromium.org/p/chromium/issues/detail?id=624128#c8 https://bugs.chromium.org/p/chromium/issues/detail?id=624128... Widevine is bundled and setting this policy just disables the updates. Also it seems that this setting disables updates for all components, most notably Flash. While I don't want Widevine (enabled) on my machine at all, I do want Flash updated automatically for the rare times I have to use it.
gregw2 10y ago
Chrome similarly used to honor the /etc/hosts file, first by default, then via setting. Now it always uses Google's DNS, no workarounds. I cant create localhost aliases for dev VMs nor can I block distracting sites. I've switched back to firefox.
- Renevith 10y ago
  Ironically, this "feature" prevented me from getting good access to Google's own services. I was only getting routed to a saturated Google datacenter (the NUQ range, e.g. nuq04s01-in-f1.1e100.net). When I just blocked all those servers, it detected that and sent me to another range of servers (LAX) that worked much faster... but I used Firefox every time I wanted to open Google Maps because that trick didn't work from Chrome!
hobarrera 10y ago
I strongly stand behind the complain vs DRM/forcing HDCP/etc, but: What's the big deal with background throttling? On a day to day basis, how many scenarios are there where you need a background tab using CPU and doing page updates? IMHO, it makes sense for background tabs to get throttled to save power, since 99.9% of the times, you don't need the updates (I'd say 100%, but I'm sure there'll be at least ONE counter-example).

446 points by ivank 10y ago

Looks like the semi-official Google position is that Widevine should have been impossible to disable all along [1]. Go figure. [1]: https://bugs.chromium.org/p/chromium/issues/detail?id=615738#c31 https://bugs.chromium.org/p/chromium/issues/detail?id=615738...

mixedCase 10y ago
Honestly? It makes sense and I see nothing wrong with it. Chrome is Google's opinionated version of Chromium, with the average user in mind. Everyone else should be using Chromium. There's nothing wrong or lacking in it now that the PDF module has been open sourced. If one wants Flash or Widevine, those can be installed separately.
- mtarnovan 10y ago
  If by "everyone else" you mean 0.5% market share...
  - mixedCase 10y ago
    Well I don't know about 0.5%, but a small minority? Absolutely. Most people who interact with computers don't know how to use them. And out of the people who do know how to use it, an even smaller percentage would care about using Chromium over Chrome.
- akjainaj 10y ago
  Is there a way to use a stable version of Chromium that automatically updates?
  - Jackneill 10y ago
    sudo pacman -S chromium. All decent distros ought to have it.
    - akjainaj 10y ago
      Thank you but I use Windows.
      - deleted 10y ago
        [deleted]
      - Lammy 10y ago
        It's available in Chocolatey https://chocolatey.org/packages/chromium https://chocolatey.org/packages/chromium
      - ndesaulniers 10y ago
        Seeing you get downvoted for asking genuine questions to a technical community reminds me that I need to find a new one. Stack Overflow 2.0, here we come. No question now what has happened to the faces of the pigs. The creatures outside looked from pig to man, and from man to pig, and from pig to man again: but already it was impossible to say which was which.
      - s_kilk 10y ago
        > decent distros
  - ferbivore 10y ago
    This page [1] has an overview of everything you need to know about using Chromium as a day-to-day browser, including a section on auto-updaters [2]. [1]: https://chromium.woolyss.com/ https://chromium.woolyss.com/ [2]: https://chromium.woolyss.com/#updater https://chromium.woolyss.com/#updater
- drinkjuice 10y ago
  > with the average user in mind. And what average user would have a need for there being no way to disable it?
  - mixedCase 10y ago
    The average user doesn't need to nor doesn't want to know about the existence of Widevine. And if he's told about it, he wouldn't care about it, he just wants to watch Netflix.
    - devwastaken 10y ago
      Talking about use cases when it comes to widely used software is a null argument in most contexts. It was previously disablable, preventing that now is just taking features away without a benefit. Its automatically enabled for all the people that don't know about it, but need it anyway.
    - PhasmaFelis 10y ago
      You haven't answered the question. What user benefits from removing this feature? This isn't for the benefit of any user, "average" or otherwise.
      - CJefferson 10y ago
        Users who don't understand it, disable it either accidentally, or based in bad advice, then don't know why Netflix doesn't work, probably in 2 years time when they long since forgot editing it. As the years go by, I learn every config option is going to lead to some set of users getting confused and upset.
        drinkjuice 10y ago
        So some parties pushing hard for DRM has nothing to do with it, whatsoever? It's all about preemptively avoiding horrible user pain and incredible customer support costs, correct? Then explain the million options left over in chrome://flags/ ? Oh, snap. Looks like that explanation doesn't even begin to make sense, and it's hilarious how the "average user", in their absence, gets used as an excuse to implement outright hostile things, but only then. When Google Reader shuts down or other things are done nobody likes, which not one person welcomes, that doesn't matter, it's only when it's about things no user wants but companies want to push when they suddenly do. The bug report mentions real problems caused by this change. Are there similar reports about problems that were caused by that option being available, or is that all just theoretical? > As the years go by, I learn every config option is going to lead to some set of users getting confused and upset. So? Remove all config options, or simply do good work and let the remaining complainers complain? Why not take the person who filed the bug report and is "confused and upset" for very good reasons they can argue for more seriously than some random hypothetical person?
- venomsnake 10y ago
  Just tell me where in Chromium to disable resetting user profile when it detects tampering - so I am able to migrate a profile just by copying and I will move to Chromium in a second. The not being able to copy your profile between machines is terrible terrible decision. It detects "tampering" and nukes everything :(
  - mh- 10y ago
    I've not personally used this, but it should work for your use case. http://www.chromium.org/administrators/policy-list-3#RoamingProfileLocation http://www.chromium.org/administrators/policy-list-3#Roaming... (note that the 'roaming location' could still just be a folder on your local drive.) > If you enable this setting, the settings stored in Google Chrome profiles like bookmarks, autofill data, passwords, etc. will also be written to a file stored in the Roaming user profile folder or a location specified by the Administrator through the Google Chrome policy.

swiley 10y ago

Google is turning the web into things it never should have become. It's very sad.

digi_owl 10y ago
The other shoe is dropping?
Silhouette 10y ago
Sadly, I think it's popular demand that is changing the nature of the Web. Google is just taking advantage of the situation in ways that benefit themselves, as is almost everyone else in the modern Web ecosystem.
- kijin 10y ago
  There is no such thing as popular demand, only what major web companies think will benefit their bottom line. They just supply what they want to supply and invent demand to justify it post facto. Nobody outside of the MAFIAA demanded a flickering, crashy, proprietary DRM module for the web. But since that's what Google can supply at this time, they would like all of us to pretend that there's some sort of popular demand for it. All these players add so many layers of deliberately misleading interpretation and assumptions on top of what ordinary users might actually want, it's impossible to figure out which "demands" are authentic and which ones are mere illusions anymore.
  - Silhouette 10y ago
    The popular demand isn't for DRM, it's for being able to watch movies and TV shows through online streaming instead of going out to the cinema or waiting for something to be on TV. The people making those movies and TV shows are only willing to let services put them online if those services offer certain safeguards to prevent flagrant abuse. Hence, we get DRM in online streaming systems. People who object for some reason can either disable it or use a different browser, but the price is that they don't get to stream the content. Meanwhile, most people don't know or care what DRM is or how it works, as long as they can binge-watch their favourite drama or enjoy a new movie with their family on a Saturday night.

adzm 10y ago

Is there a technical reason that this can't simply be disabled with a feature flag like many of Chrome's other features? It would avoid the whole issue. Also reading this bug report makes me realize this is probably what was going on when I had similar strange issues happen with chrome and tabs and running stuff through HDMI splitters for KVM etc.

zeta0134 10y ago
There isn't a technical reason it shouldn't be able to be implemented. Mostly it's a matter of getting the UI preference hooked up; it looks like they've already done something similar with the Flash plugin for users which wish to disable Flash, and this is a similar case. The reality of the Flash situation is quite messy, with a ton of websites relying on nonstandard behavior and checks to see if Flash is even installed, and Google seems to have missed the use case for disabling the plugin entirely, rather than just blocking it. This seems like a similar oversight. I'm torn here, as I see what Google is trying to accomplish with their settings spread. Mostly, the browser has chosen quite sensible defaults for the bulk of its users that needs the web to JustWork(tm) and they're hesitant to add extra checkboxes to avoid confusing folks. But with the politically charged nature of DRM, as well as the technical issues presented here (HDMI / HDCP is notoriously finnicky and the user should have more control over when it's enabled) I think a checkbox to disable the plugin entirely, similar to Flash, is the best solution.
- paralelogram 10y ago
  Non-standard ways of embedding Flash are common because of Eolas patents: https://en.wikipedia.org/wiki/Eolas#Effects_on_other_browsers https://en.wikipedia.org/wiki/Eolas#Effects_on_other_browser... https://msdn.microsoft.com/en-us/library/ms537508.aspx https://msdn.microsoft.com/en-us/library/ms537508.aspx

shmerl 10y ago

I'm glad Mozilla provides EME-free version of Firefox: https://ftp.mozilla.org/pub/firefox/releases/51.0/ https://ftp.mozilla.org/pub/firefox/releases/51.0/

hansjorg 10y ago
Normal Firefox builds also provide a checkbox under the Content settings to disable it. As far as I recall, I've never touched the setting, but it's disabled here.
- shmerl 10y ago
  I suppose EME-free builds prevent even the possibility of enabling it.
  - cpeterso 10y ago
    You can technically re-enable EME in the "EME-free" Firefox builds by setting the "media.eme.enabled" pref in about:config. The term "EME-free" is a bit of misnomer. The "EME-free" builds have two differences from regular Firefox builds: the Widevine CDM downloader is disabled and the "Play DRM content" setting checkbox is hidden.
    - shmerl 10y ago
      I see, thanks. I hoped they actually disabled EME functionality at the build time. That would have made more sense.
      - kuschku 10y ago
        Well, Firefox does not contain EME functionality itself – if it’s needed, and activated, it just downloads the binary and runs it. The EME-free builds just have that download code disabled, and the setting for it hidden.
        10y ago

robxu9 10y ago

TIL that Widevine DRM is the reason my HDMI monitor flashes whenever I start or stop viewing something on Netflix or Amazon Video. Welp.

akerro 10y ago
Hello Firefox!
- jasonkostempski 10y ago
  Hello Silverlight if you want Netflix too.
  - dolske 10y ago
    Firefox also includes Widevide, so Silverlight is no longer needed. Netflix works just fine with it. (https://blog.mozilla.org/futurereleases/2016/04/08/mozilla-to-test-widevine-cdm-in-firefox-nightly/ https://blog.mozilla.org/futurereleases/2016/04/08/mozilla-t...) It also includes UI to indicate when DRM content is being played, and there's a UI pref to disable DRM support entirely, if that's your thing.
- cpeterso 10y ago
  Firefox also uses Google's Widevine CDM. I'm curious if the HDMI monitor flashes are an issue with Chrome's integration with Widevine or in Widevine itself (and thus also affecting Firefox).
  - syshum 10y ago
    Monitor Flashes because internally is basically changing inputs as it changes from unencrypted video to encrypted HDCP video
- tedunangst 10y ago
  How does one use Firefox without widevine to watch a DRM video stream?

0x0 10y ago

This + moving SSL certificate details dialog hidden away into devtools + no way to disable NaCl + chrome 56 auto-re-enabling flash and widevine on every launch (which shows a click-to-enable-flash everywhere chrome55 would just use a html5 video player) + the upcoming background tab throttling means I'll be seriously reconsidering firefox or safari before the next Chrome release :-/

malikNF 10y ago
I have actually started using firefox again recently, chrome has lost me due to how hard they (and Google as a company) are trying to push things on to people. Anyways, I am in love with the nightly build of ff and everyone should honestly give it atleast a week of their time to try it. The developer edition and the nightly build have some really interesting features for development out of the box and honestly helps make work easier. You do run in to the occasional error or two but for pre-release versions they are seriously stable. p.s https://news.ycombinator.com/item?id=12579163 https://news.ycombinator.com/item?id=12579163 (Choose Firefox Now, or Later You Won't Get a Choice (2014))
- chimeracoder 10y ago
  One thing to note - Nightly is compiled with certain debugging flags enabled, whereas Developer Edition is not. There is a slight performance hit, which is not always noticeable, but I mention it in case anybody tries Nightly and finds it slow.
  - johnp_ 10y ago
    It should be noted that some of those features can be disabled via environment variables: https://developer.mozilla.org/docs/Mozilla/Benchmarking https://developer.mozilla.org/docs/Mozilla/Benchmarking Specifically, I use those environment variables: JS_OPTION_USE_UNBOXED_ARRAYS=1 JSGC_DISABLE_POISONING=1 There's at least one other thing (async stack) that I'm aware of that may be tunable: https://bugzilla.mozilla.org/show_bug.cgi?id=1280819 https://bugzilla.mozilla.org/show_bug.cgi?id=1280819 edit: just figured out that that's "javascript.options.asyncstack", so I set it to disabled on nightly too. Fwiw, the unboxed objects bug is: https://bugzilla.mozilla.org/show_bug.cgi?id=1153266 https://bugzilla.mozilla.org/show_bug.cgi?id=1153266 edit: typedobj performance improvements visible at the bottom of https://arewefastyet.com/#machine=28&view=breakdown&suite=misc https://arewefastyet.com/#machine=28&view=breakdown&suite=mi... edit: removed MOZ_QUIET=1, as a source inspection reveals that it is only compiled #ifdef DEBUG.

nmjohn 10y ago

What a frustrating change. However it still is possible to disable (though you probably will need to do this every time chrome updates) Simply deleting the folder that contains "widevinecdmadapter.plugin" will effectively disable the plugin. So, for example, on OSX using homebrew to install chrome, it'd be: rm -rf /opt/homebrew-cask/Caskroom/google-chrome-canary/latest/Google\ Chrome\ Canary.app/Contents/Versions/58.0.2996.0/Google\ Chrome\ Framework.framework/Libraries/WidevineCdm

deleted 10y ago
[deleted]
Sunset 10y ago
You can deny write permissions to the folder.
- mschuster91 10y ago
  I wouldn't try that as it will likely break the auto-updater when it tries to update the Widevine files.
  - jaimex2 10y ago
    try it, then revert if it does break.
  - Sunset 10y ago
    Is there something like an "overlay" FUSE fs which pretend to write what you give it but then just discards what you give it and returns the actual file when you attempt to read? To defeat checks right after writes it could return what you wrote once( or a configurable number of times) but after that just give you the original file when you read it.

mtarnovan 10y ago

This might be the straw that finally pushed me to switch to some other browser. Any thoughts on Chromium vs Firefox?

joecool1029 10y ago
Edge is getting there! Surprised that this is the straw and it wasn't the hotwording binary that was pulled in to listen for "ok, google" without anyone's knowledge or permission.
- Buge 10y ago
  Is it possible to disable DRM in Edge? Did that binary ever listen to anything? And as far as I know, the hotwording binary outrage was about Chromium, not about Chrome.
- arkades 10y ago
  I'd be OK with Edge except that in Win10, Edge gets subsumed into "System" in the volume mixer. You can't lower the volume on the Edge program, like you can on Firefox, Chrome, or on previous versions of IE. In short, when ads or background music start blasting, you can either mute your entire system, or you're stuck with them - can't mute Edge specifically. That's a killer feature right there.
- ocdtrekkie 10y ago
  Edge is getting pretty good, it's UI performance is as good or better than Chrome now. BUT, if you're leaving Chrome because they include proprietary binaries, moving to Edge isn't an improvement there.
problems 10y ago
It's really a question of whether flexibility or UI performance is a higher priority for you. If you want incredible customization options, go to Firefox. If you want Chrome's UI performance, stick to Chromium.
edoceo 10y ago
Check out Vivaldi and Blisk as well

bostand 10y ago

I don't mind paying for content. In fact, I pay a lot for my content consumption as direct purchases and streaming services. But I don't like having a huge pile of unverified third party code in a browser i never use for content consumption.

asadotzler 10y ago
The CDM is a lot less of a huge pile of unverified third party code in the browser than was Flash and Silverlight before.

timonovici 10y ago

I currently use Firefox with JS disabled, for casual browsing, and Min for anything with video or JS https://minbrowser.github.io/min/ https://minbrowser.github.io/min/ - finally, after years, I can use a system with less than 8G of RAM. This browser is based on Electron - does Electron also bundle this abomination of DRM plugin?

Zardoz84 10y ago
If you disabled JS, why you not use something far more lightweight, like ELinks ?
- timonovici 10y ago
  I need images, tabs, tabgroups. The developer tools are nice to have. And I'm just used to it. It sits just below 500M of RAM, with about a hundred tabs. I can deal with that.
goodplay 10y ago
I use linux's control groups with very satisfactory results.
- bcook 10y ago
  In what way do you use them?
  - goodplay 10y ago
    I designate a separate memory control group for the browser, and set both `memory.limit_in_bytes` and `memory.memsw.limit_in_bytes` to 1.5 GB. Then the browser is launched within that group. The tools are the standard cgcreate and cgexec. When the browser depletes all its memory allowance, I use killall to kill the tab processes leaving only the chrome running. I refresh the tab I want and carry on. Might seem convoluted, but works extremely well in practice. edit: It should be noted that I currently use chromium. I intend to switch to firefox as soon as I can port this workflow to it or otherwise achieve a similar result.

murkle 10y ago

This is a useful link from there: chrome://flags/#prefer-html-over-flash

imode 10y ago

so, it's kind of worrying. I hope this kind of change won't be common among browsers. I'd rather a killswitch and a moment of "ah crap, I have to enable that" than a slew of third-party code enabled at all times. no thanks.

angryasian 10y ago
that's not how widevine works

wslh 10y ago

We are all that boiling frog [1]. Google, and others, introduced a new business tactic that is even been followed by Microsoft (in reverse mode). They push all kind of open source and free stuff and slowly, very slowly, they move to old monopolies tactics. Most locked people will not change to another browser just because they added a new "tiny" portion of code which is not political correct. [1] https://en.wikipedia.org/wiki/Boiling_frog https://en.wikipedia.org/wiki/Boiling_frog

superkuh 10y ago
Yep. And if you don't like it they (Google/Mozilla) tell you to use the developer's version. As if using an alpha was an acceptable option.
- Vinnl 10y ago
  Why include Mozilla in those parentheses?
  - mort96 10y ago
    Firefox' non-developer version is also getting more locked down. I had to change to it from the regular version when I couldn't use the extension I have written for myself anymore, because Mozilla removed the option to install unsigned extensions.

PostThisTooFast 10y ago

More Google hypocrisy.

PostThisTooFast 10y ago

More Google hypocrisy.

angryasian 10y ago

Sorry but can someone explain the problem. I'm very familiar with widevine, hls / hlse, and other various DRM type solutions. To me it appears a lot of uninformed answers or something that's completely blown out of proportion. So looking for someone to explain ?

jnky 10y ago
What do you want to know about the problem? I wrote the bug report that this thread is about. I think my reasons for arguing there should be a way to disable Widevine are very clear. To sum it up again: - Widevine DRM has usability issues (mostly because of HDCP) ad well as stability issues, as outlined in the bug report. - I am politically opposed to HTML EME and I don't want it enabled in my browser. I would like it better if it was unavailable to begin with. - From a security perspective, allowing every web site that I allow Javascript on to talk to some dubious blob behind my back is the last thing I want.

deleted 10y ago

[deleted]

raldi 10y ago

Can someone explain this in a way that assumes no prior knowledge of Widevine or EME?

josteink 10y ago
It's HTML DRM. Most technical people are vocally opposed to it and don't want to leave a single trace in a single server log contributing to the idea that it is widely accepted and available. A browser not only implementing DRM, but leaving you no way to disable it is seriously anti-user. But this is Google, so go figure.
- raldi 10y ago
  So I know what HTML is, and I know what DRM is, but I don't understand what you mean by "HTML DRM". And googling [widevine] is not helping.
  - josteink 10y ago
    HTML has always been an open standard. Every part has been open. Just by reading the spec, you could implement a fully functional web-browser. There were no secrets bits or black boxes. So people went ahead did just that. They made new and exciting web-browsers, with new and novel features, on lots and lots of platforms. And that's why the web was a success: It was open to use by people. It was open for new clients. Nothing was locked down. With DRM in the HTML spec comes a big, black box: You can no longer implement a fully compliant web browser from the spec alone. You'll need closed-source blobs from DRM vendors, if they are willing to provide them to you, and if they bother about compatibility with your browser, your OS, not to mention your HW architecture. The web used to be 100% open and 100% cross-platform. The single move of adding DRM instead makes it a platform which now will only be 100% "compliant" in browsers blessed by DRM vendors, on OSes blessed by DRM vendors, on HW architectures which the DRM-vendors has bothered to implement DRM for. It's a complete turn-around. A 100% FOSS web-browser can no longer be made. It basically has put the 3 top DRM-vendors (Apple, Google, MS) in 100% control of which people, and on which operating systems, can get to have a full web experience. I guess I don't need to argue why this is bad. You can take it from here, right?

BrendanEich 10y ago

That's interesting, because Brave has Widevine off by default and includes this notice in the preference UX for enabling it: --- Google Widevine Support Google Widevine is a piece of Digital Rights Management (DRM) code that we at Brave Software do not own and cannot inspect. The Google Widevine code is loaded from Google servers, not from our servers. It is loaded only when you enable this option. We discourage the use of DRM, but we respect user choice and acknowledge that some Brave users would like to use services that require it. [info link to https://www.eff.org/issues/drm https://www.eff.org/issues/drm] By installing this extension, you are agreeing to the Google Widevine Terms of Use. You agree that Brave is not responsible for any damages or losses in connection with your use of Google Widevine. [info link to https://www.google.com/policies/terms/ https://www.google.com/policies/terms/] Enable Google Widevine support [button label] --- You can view this as a DRM mandate canary if you like. It's still in Brave 0.13.0. That's all I have to say for now.

BrendanEich 10y ago
We don't even load the DRM module (CDM) until that pref is enabled, note well.

bartvk 10y ago

I've moved to Firefox on my MacBook. To make it a bit more macOS-like, there's two nice plugins: https://addons.mozilla.org/en-US/firefox/addon/pinch-to-zoom-firefox-osx/ https://addons.mozilla.org/en-US/firefox/addon/pinch-to-zoom... for pinch-to-zoom https://addons.mozilla.org/en-US/firefox/addon/compact-theme/ https://addons.mozilla.org/en-US/firefox/addon/compact-theme... for a theme that makes it look more Safari-like

baybal2 10y ago

Oh, thats why my hdmi splitter goes down every time on vimeo

neurobot 10y ago

i switch from Firefox only if i want to watch video on non-HTML5 website.

rabboRubble 10y ago

Funny enough in Firefox Widevine was default set to Always Activate on my machine. Not sure how long it's been that way. There was no "ask to activate" option. I was however able to set to "never activate". Let's see how long before this becomes annoying.

jnky 10y ago
Surfing with Widevine disabled is no problem at all. Netflix and Amazon Prime Video do not work, though.
- rabboRubble 10y ago
  thanks... thinking about this more, I don't even recall installing Widevine at any point in the past. Perhaps bundled with FF? Fortunately, I never stream Netflix / AP to my computers.

Fej 10y ago

You know what they say - switch to Firefox now, or you won't have a choice later.

BrendanEich 10y ago
Robert O'Callahan said that, but then he left. I wish he had not said it, and so do many other heavy hitters who are or were at Mozilla. It makes Firefox sound like a pity-f$#k, or a sin tax. At worst, a feel-good gesture that has unintended consequences. If you like Firefox, use it! If you like Brave, either for the speed and safety of our 3rd party ad/tracker blocking that's on by default; or for the post-browser, user-data-sovereignty economics we're building to sustain; then use Brave. If you like Vivaldi, use it. And so on. But don't make a cult out of one particular browser. Open source is not an issue. FYI, Brave is all open source.
- anonlineperson 10y ago
  Just please don't use IE unless its unavoidable

goslackware 10y ago

It appears that DRM in Chrome might be disabled by disabling the "WidevineCDM" (binary) component update via group policy: https://bugs.chromium.org/p/chromium/issues/detail?id=624128 https://bugs.chromium.org/p/chromium/issues/detail?id=624128

jnky 10y ago
I don't think that works. As per https://bugs.chromium.org/p/chromium/issues/detail?id=624128#c8 https://bugs.chromium.org/p/chromium/issues/detail?id=624128... Widevine is bundled and setting this policy just disables the updates. Also it seems that this setting disables updates for all components, most notably Flash. While I don't want Widevine (enabled) on my machine at all, I do want Flash updated automatically for the rare times I have to use it.

gregw2 10y ago

Chrome similarly used to honor the /etc/hosts file, first by default, then via setting. Now it always uses Google's DNS, no workarounds. I cant create localhost aliases for dev VMs nor can I block distracting sites. I've switched back to firefox.

Renevith 10y ago
Ironically, this "feature" prevented me from getting good access to Google's own services. I was only getting routed to a saturated Google datacenter (the NUQ range, e.g. nuq04s01-in-f1.1e100.net). When I just blocked all those servers, it detected that and sent me to another range of servers (LAX) that worked much faster... but I used Firefox every time I wanted to open Google Maps because that trick didn't work from Chrome!

hobarrera 10y ago

I strongly stand behind the complain vs DRM/forcing HDCP/etc, but: What's the big deal with background throttling? On a day to day basis, how many scenarios are there where you need a background tab using CPU and doing page updates? IMHO, it makes sense for background tabs to get throttled to save power, since 99.9% of the times, you don't need the updates (I'd say 100%, but I'm sure there'll be at least ONE counter-example).