4 ms·

Mozilla ended up accepting EME in 2014, because otherwise it would have become "the browser where you cannot see videos" https://hacks.mozilla.org/2014/05/recon

Mozilla ended up accepting EME in 2014, because otherwise it would have become "the browser where you cannot see videos" https://hacks.mozilla.org/2014/05/reconciling-mozillas-mission-and-w3c-eme/ https://hacks.mozilla.org/2014/05/reconciling-mozillas-missi... "We have come to the point where Mozilla not implementing the W3C EME specification means that Firefox users have to switch to other browsers to watch content restricted by DRM."

wolfgke 9y ago
> Mozilla ended up accepting EME in 2014, because otherwise it would have become "the browser where you cannot see videos" Rather: "the browser where you cannot see DRM-infected video" - which is an active protection of the user against malware.
- untog 9y ago
  ...and which no-one will download. To be clear: if DRM is not implemented in browsers, Netflix and the like will just make native apps, which are far larger vectors of malware attack than the locked down EME standard is. I'm not saying this is a good thing, but "people should just not watch DRMed video" is not an actual answer to the problem at hand.
  - wolfgke 9y ago
    So you claim that Firefox (and other browsers) should implement malware or a malware interface into their browser so that users don't have a reason to download and install some other malware?
    - untog 9y ago
      No, I am saying that browser manufacturers should slightly increase their vulnerability surface area (and maybe not at all - I don't know the internals of EME) in order to provide a locked-down feature to users that they would only otherwise get by downloading a native app that has access to their local file system, amongst other valuable things. It's the same logic that leads to them to support JavaScript.
      - 4bpp 9y ago
        Assuming the motivating reasoning here is that the overarching goal of the browser vendor should be to protect the user, the question still is what timeframe it is appropriate to consider. If the browser does not implement DRM, the user may download an infected native app to watch Netflix or porn from some far shadier website or whatever, sustaining more harm in the short run; however, if the user then is repeatedly infected with malware, chances are it will not take long for a general understanding that downloadable video players are garbage-piled-up-on-grandpa's-computer bad (in the same way that IE toolbar plugins or warez websites' "special download managers" were) to take root. This will maybe chip away at the addictive convenience of Netflix and co, and so they won't be able to dictate terms to the computing ecosystem as they evidently can right now, benefiting the user in the long run.
        emodendroket 9y ago
        > however, if the user then is repeatedly infected with malware, chances are it will not take long for a general understanding that downloadable video players are garbage-piled-up-on-grandpa's-computer bad (in the same way that IE toolbar plugins or warez websites' "special download managers" were) to take root This is clearly written from the perspective of somebody who never did help desk work or helped family or friends with computer problems.
        4bpp 9y ago
        Your point being... that I underestimate how people will keep downloading them anyway? I haven't done help desk work, but have been asked to do plenty of the latter; over the years, at least in my vicinity, skepticism about downloadable plugins had certainly developed to a level where I would only ever see the "half of the window is toolbars" IE screenshots in 4chan /g/ snark threads anymore.
        emodendroket 9y ago
        Yeah, that was my point... unless things have like drastically changed in the last few years I think you're overestimating the level of user education.
    - pdpi 9y ago
      I don't know about the GP. I claim that a form of DRM that Mozilla begrudgingly accepts into Firefox has better odds of not turning out to to be "Sony Rootkit" literal malware than if everybody else is rolling their own. This battle is lost, let's not lose the war to have our little Alamo moment.
    - zaphar 9y ago
      If Firefox doesn't support DRM Video Mozilla dies. Users will not use a browser where they can't watch the videos they want to watch and those videos are under DRM. You can't solve this problem at the standard level or the browser level. You can only solve by education users enough that they see no DRM as a feature and at the legal level by enshrining user protections in law.
  - YSFEJ4SWJUVU6 9y ago
    For all the DRM Netflix has pushed down our throats, they still serve many titles (mainly movies and not their own productions) in piss-poor quality with those browsers whose users' freedom they have crippled. And I do mean absolutely awful quality as some titles clock in at less than 1000 kbps which isn't even nowhere near DVD quality.
    - emodendroket 9y ago
      What's one thing got to do with the other?
  - appleflaxen 9y ago
    that's the whole point: if your product is so amazing that your users will do that, then it's great! but those of us who are NOT your customers will be able to exist without the attack surface on our machine.
  - ekianjo 9y ago
    > To be clear: if DRM is not implemented in browsers, Netflix and the like will just make native apps, which are far larger vectors of malware attack than the locked down EME standard is. False dichotomy. Instead of exposing a small percentage of users to large attack vector (native app), you are exposing a very large percentage of users (close to 100%) with a lower attach vector. THe potential for damage is much, much higher, since it would affect about everyone using the Internet with major browsers.
- gcp 9y ago
  which is an active protection of the user against malware. You should look at how Mozilla implemented EME then. The CDM is sandboxed, in a much stricter sandbox than the rest of the browser even. So no, the CDM potentially being dangerous (for privacy or security) isn't actually that much of an issue. Of course, someone might at some point claim that the privacy features harm the copyrights protection, at which point choices will have to be made. History provide ample evidence that Mozilla will make the choice their users ask for (which is, by the way, not necessarily the choice some users will voice the most loudly).

wolfgke 9y ago

> Mozilla ended up accepting EME in 2014, because otherwise it would have become "the browser where you cannot see videos" Rather: "the browser where you cannot see DRM-infected video" - which is an active protection of the user against malware.

untog 9y ago
...and which no-one will download. To be clear: if DRM is not implemented in browsers, Netflix and the like will just make native apps, which are far larger vectors of malware attack than the locked down EME standard is. I'm not saying this is a good thing, but "people should just not watch DRMed video" is not an actual answer to the problem at hand.
- wolfgke 9y ago
  So you claim that Firefox (and other browsers) should implement malware or a malware interface into their browser so that users don't have a reason to download and install some other malware?
  - untog 9y ago
    No, I am saying that browser manufacturers should slightly increase their vulnerability surface area (and maybe not at all - I don't know the internals of EME) in order to provide a locked-down feature to users that they would only otherwise get by downloading a native app that has access to their local file system, amongst other valuable things. It's the same logic that leads to them to support JavaScript.
    - 4bpp 9y ago
      Assuming the motivating reasoning here is that the overarching goal of the browser vendor should be to protect the user, the question still is what timeframe it is appropriate to consider. If the browser does not implement DRM, the user may download an infected native app to watch Netflix or porn from some far shadier website or whatever, sustaining more harm in the short run; however, if the user then is repeatedly infected with malware, chances are it will not take long for a general understanding that downloadable video players are garbage-piled-up-on-grandpa's-computer bad (in the same way that IE toolbar plugins or warez websites' "special download managers" were) to take root. This will maybe chip away at the addictive convenience of Netflix and co, and so they won't be able to dictate terms to the computing ecosystem as they evidently can right now, benefiting the user in the long run.
      - emodendroket 9y ago
        > however, if the user then is repeatedly infected with malware, chances are it will not take long for a general understanding that downloadable video players are garbage-piled-up-on-grandpa's-computer bad (in the same way that IE toolbar plugins or warez websites' "special download managers" were) to take root This is clearly written from the perspective of somebody who never did help desk work or helped family or friends with computer problems.
        4bpp 9y ago
        Your point being... that I underestimate how people will keep downloading them anyway? I haven't done help desk work, but have been asked to do plenty of the latter; over the years, at least in my vicinity, skepticism about downloadable plugins had certainly developed to a level where I would only ever see the "half of the window is toolbars" IE screenshots in 4chan /g/ snark threads anymore.
        emodendroket 9y ago
        Yeah, that was my point... unless things have like drastically changed in the last few years I think you're overestimating the level of user education.
  - pdpi 9y ago
    I don't know about the GP. I claim that a form of DRM that Mozilla begrudgingly accepts into Firefox has better odds of not turning out to to be "Sony Rootkit" literal malware than if everybody else is rolling their own. This battle is lost, let's not lose the war to have our little Alamo moment.
  - zaphar 9y ago
    If Firefox doesn't support DRM Video Mozilla dies. Users will not use a browser where they can't watch the videos they want to watch and those videos are under DRM. You can't solve this problem at the standard level or the browser level. You can only solve by education users enough that they see no DRM as a feature and at the legal level by enshrining user protections in law.
- YSFEJ4SWJUVU6 9y ago
  For all the DRM Netflix has pushed down our throats, they still serve many titles (mainly movies and not their own productions) in piss-poor quality with those browsers whose users' freedom they have crippled. And I do mean absolutely awful quality as some titles clock in at less than 1000 kbps which isn't even nowhere near DVD quality.
  - emodendroket 9y ago
    What's one thing got to do with the other?
- appleflaxen 9y ago
  that's the whole point: if your product is so amazing that your users will do that, then it's great! but those of us who are NOT your customers will be able to exist without the attack surface on our machine.
- ekianjo 9y ago
  > To be clear: if DRM is not implemented in browsers, Netflix and the like will just make native apps, which are far larger vectors of malware attack than the locked down EME standard is. False dichotomy. Instead of exposing a small percentage of users to large attack vector (native app), you are exposing a very large percentage of users (close to 100%) with a lower attach vector. THe potential for damage is much, much higher, since it would affect about everyone using the Internet with major browsers.
gcp 9y ago
which is an active protection of the user against malware. You should look at how Mozilla implemented EME then. The CDM is sandboxed, in a much stricter sandbox than the rest of the browser even. So no, the CDM potentially being dangerous (for privacy or security) isn't actually that much of an issue. Of course, someone might at some point claim that the privacy features harm the copyrights protection, at which point choices will have to be made. History provide ample evidence that Mozilla will make the choice their users ask for (which is, by the way, not necessarily the choice some users will voice the most loudly).