8 ms·

I'm guessing they're on the same boat as Tim Berners-Lee, thinking it a necessary evil if the world wants big budget films delivered through their browser. Pers

I'm guessing they're on the same boat as Tim Berners-Lee, thinking it a necessary evil if the world wants big budget films delivered through their browser. Personally, I'd only get on that boat if my life depended on it, which I think is the case for Netflix (I'm still not sure why TBL is on it). I think Netflix is at least fighting for DRM that isn't based on rootkits, something of a win for the general population.

zAy0LfpBZLC8mAC 9y ago
> I think Netflix is at least fighting for DRM that isn't based on rootkits But you have read the headline, haven't you? They only work with a google rootkit installed, now.
- geofft 9y ago
  I think that describing Google Play Services (or Android? or I'm-not-sure-what) as "a google rootkit" isn't super conducive to a meaningful discussion, even if there's a technical interpretation under which it's true. In particular, most users of Netflix on Android have a threat model that involves Google legitimately having the ability to push software updates to the phone that run as root. So "rootkit" is not a very useful term, any more than describing any Debian package maintainer script as a "random volunteer's rootkit" would be.
  - zAy0LfpBZLC8mAC 9y ago
    Suppose you needed to install this particular Debian package with root privileges (well, necessarily, but you get the point) that you otherwise would not want to install and that then goes on to enforce a certain behaviour of your computer against your interests as a prerequisite for using some other piece of software. Suppose further that someone put forward the argument that it's not so bad, as at least there is no rootkit involved. Then, yes, it would obviously be perfectly sensible to in that context call that Debian package a "random volunteer's rootkit". Whether most users would like to have some other functionality provided by that same package is completely irrelevant to the question at hand, as is whether most users would install the package.
    - geofft 9y ago
      > Suppose you needed to install this particular Debian package with root privileges (well, necessarily, but you get the point) that you otherwise would not want to install and that then goes on to enforce a certain behaviour of your computer against your interests as a prerequisite for using some other piece of software. This happens to lots of people under the name of systemd. I think any definition of "rootkit" that includes involuntary installations of systemd is so broad that we cannot conclude anything from the term. (There are legitimate criticism of Debian requiring systemd, but they're basically entirely orthogonal from the criticisms of, say, the Sony BMG rootkit.) So, let me ask - what in particular are you seeing as the "google rootkit," and how would you describe its negative behavior in words other than "it's a rootkit"?
      - zAy0LfpBZLC8mAC 9y ago
        > So, let me ask - what in particular are you seeing as the "google rootkit," and how would you describe its negative behavior in words other than "it's a rootkit"? Well, I am not all that well-versed in Android/Google components/APIs/whatever, so I can't really tell you what specific component that would be, but as I understand it, there is some mechanism provided by the platform that allows an app to check whether the owner is locked out from controlling their own device, right? So, it's some component with high privileges that gives the power to control how you use your device to a party that's not you ... now, "rootkit" isn't really all that clearly defined, but I would say that that's clearly the core of what makes a rootkit a rootkit, don't you think?
        geofft 9y ago
        The relevant service provides some information about your device to Google, which makes a decision (I'd assume based on heuristics or ML) about your device's integrity compared to Google's baseline. An app's vendor can choose to condition the Play Store entry on the result of the Google calculation. A rootkit, traditionally, hides its existence from you and provides root access (i.e., code execution as root) for some outside attacker. Oxford defines it as "a set of software tools that enable an unauthorized user to gain control of a computer system without being detected;" Veracode defines it as "a clandestine computer program designed to provide continued privileged access to a computer while actively hiding its presence;" Wikipedia, citing McAfee, says that a it's "designed to enable access to a computer or areas of its software that would not otherwise be allowed (for example, to an unauthorized user) and often masks its existence or the existence of other software." I think these two properties are the core of what makes a rootkit a rootkit (and also the core of what makes it bad). This Google service neither attempts to hide its existence nor does it provide remote access / code execution to anyone. The closest term I can think of for something that provides information to others is "spyware", but even that's a serious stretch. This utility is most similar to the function called by desktop software installers that check to see if you have enough disk space, so the installer can choose to abort based on the result. And I'd definitely not call that a "rootkit" or "spyware".
geofft 9y ago
Aren't HTML5 EME plugins sandboxable, though? That is, aren't they definitely not rootkits?
- jasonkostempski 9y ago
  I wasn't saying HTML5 EME supported rootkits. DRM doesn't belong in the web standard, that's a fundamental belief of mine against DRM in general. I'm saying TBL and Netflix are both campaigning for non-rootkit-like DRM, better than the worst DRM, but DRM none the less. Netflix is a company, it's only real concern is making money, regardless what they're owners/employees personally believe, they won't get big budget films without it, so I understand why they're working for "Good" DRM. But no individual should be lobbying for "better" DRM.

zAy0LfpBZLC8mAC 9y ago

> I think Netflix is at least fighting for DRM that isn't based on rootkits But you have read the headline, haven't you? They only work with a google rootkit installed, now.

geofft 9y ago
I think that describing Google Play Services (or Android? or I'm-not-sure-what) as "a google rootkit" isn't super conducive to a meaningful discussion, even if there's a technical interpretation under which it's true. In particular, most users of Netflix on Android have a threat model that involves Google legitimately having the ability to push software updates to the phone that run as root. So "rootkit" is not a very useful term, any more than describing any Debian package maintainer script as a "random volunteer's rootkit" would be.
- zAy0LfpBZLC8mAC 9y ago
  Suppose you needed to install this particular Debian package with root privileges (well, necessarily, but you get the point) that you otherwise would not want to install and that then goes on to enforce a certain behaviour of your computer against your interests as a prerequisite for using some other piece of software. Suppose further that someone put forward the argument that it's not so bad, as at least there is no rootkit involved. Then, yes, it would obviously be perfectly sensible to in that context call that Debian package a "random volunteer's rootkit". Whether most users would like to have some other functionality provided by that same package is completely irrelevant to the question at hand, as is whether most users would install the package.
  - geofft 9y ago
    > Suppose you needed to install this particular Debian package with root privileges (well, necessarily, but you get the point) that you otherwise would not want to install and that then goes on to enforce a certain behaviour of your computer against your interests as a prerequisite for using some other piece of software. This happens to lots of people under the name of systemd. I think any definition of "rootkit" that includes involuntary installations of systemd is so broad that we cannot conclude anything from the term. (There are legitimate criticism of Debian requiring systemd, but they're basically entirely orthogonal from the criticisms of, say, the Sony BMG rootkit.) So, let me ask - what in particular are you seeing as the "google rootkit," and how would you describe its negative behavior in words other than "it's a rootkit"?
    - zAy0LfpBZLC8mAC 9y ago
      > So, let me ask - what in particular are you seeing as the "google rootkit," and how would you describe its negative behavior in words other than "it's a rootkit"? Well, I am not all that well-versed in Android/Google components/APIs/whatever, so I can't really tell you what specific component that would be, but as I understand it, there is some mechanism provided by the platform that allows an app to check whether the owner is locked out from controlling their own device, right? So, it's some component with high privileges that gives the power to control how you use your device to a party that's not you ... now, "rootkit" isn't really all that clearly defined, but I would say that that's clearly the core of what makes a rootkit a rootkit, don't you think?
      - geofft 9y ago
        The relevant service provides some information about your device to Google, which makes a decision (I'd assume based on heuristics or ML) about your device's integrity compared to Google's baseline. An app's vendor can choose to condition the Play Store entry on the result of the Google calculation. A rootkit, traditionally, hides its existence from you and provides root access (i.e., code execution as root) for some outside attacker. Oxford defines it as "a set of software tools that enable an unauthorized user to gain control of a computer system without being detected;" Veracode defines it as "a clandestine computer program designed to provide continued privileged access to a computer while actively hiding its presence;" Wikipedia, citing McAfee, says that a it's "designed to enable access to a computer or areas of its software that would not otherwise be allowed (for example, to an unauthorized user) and often masks its existence or the existence of other software." I think these two properties are the core of what makes a rootkit a rootkit (and also the core of what makes it bad). This Google service neither attempts to hide its existence nor does it provide remote access / code execution to anyone. The closest term I can think of for something that provides information to others is "spyware", but even that's a serious stretch. This utility is most similar to the function called by desktop software installers that check to see if you have enough disk space, so the installer can choose to abort based on the result. And I'd definitely not call that a "rootkit" or "spyware".

geofft 9y ago

Aren't HTML5 EME plugins sandboxable, though? That is, aren't they definitely not rootkits?

jasonkostempski 9y ago
I wasn't saying HTML5 EME supported rootkits. DRM doesn't belong in the web standard, that's a fundamental belief of mine against DRM in general. I'm saying TBL and Netflix are both campaigning for non-rootkit-like DRM, better than the worst DRM, but DRM none the less. Netflix is a company, it's only real concern is making money, regardless what they're owners/employees personally believe, they won't get big budget films without it, so I understand why they're working for "Good" DRM. But no individual should be lobbying for "better" DRM.