5 ms·
> the many crypto-currency members of the W3C warned that using browsers for secure, high-stakes applications like moving around peoples' life-savings could onl
by bambax 9y ago
> the many crypto-currency members of the W3C warned that using browsers for secure, high-stakes applications like moving around peoples' life-savings could only happen if browsers were subjected to the same security investigations as every other technology in our life (except DRM technologies)
That's a very big point that's not emphasized enough in the article, IMHO.
If security researchers are (legally) prohibited from investigating EME technologies in browsers, then EME extensions become a big vector attack, and standards-compliant browsers that include them, become much less secure than browsers that don't.
As a user, I care about that a lot more than I care about Netflix' competitors. Netflix is not only unjustly protecting itself from future competition, it is directly threatening my own safety.
- JulianMorrison 9y agoEME is basically the new Flash Plugin.
- _jal 9y agoYep, and I will cripple it just like I did Flash. Any site depending on EME will not see traffic from me.
- imhoguy 9y agoBut then you need to disable of WebAssembly too -- another DRM lobbied standard.
- steveklabnik 9y agoCould you elaborate on this? Wasm has nothing to do with DRM as far as I can tell.
- imhoguy 9y agoNot directly, but encourages obfuscated binary blobs, like some DRM decoders and as a new complexity also new security challenges. It is come back to Flash, ActiveX or Java Applets. See top comments: https://news.ycombinator.com/item?id=10487713 https://news.ycombinator.com/item?id=10487713
- steveklabnik 9y agoView source has always been a priority for the wasm folks, and it's supported a debuggable text-based format the whole time for this reason. It's also significantly different than Flash, ActiveX, or Java Applets.
- josteink 9y agoSure thing. Except we were sold and promised cross-platform works everywhere DRM if we just included EME because “EME will be a standard”? Oops. How did that work out? Guess saying “I told you so?” won’t do much at this point.
- Mindwipe 9y agoNot by anyone who'd ever read the spec you weren't.
- jstanley 9y agoYou don't need to worry about it. If nobody is allowed to look for vulnerabilities in EME, none will be found. So we're all safe :) Personally I think we should make it illegal to look for vulnerabilities in all software. And while we're at it, just on the off chance that somebody does come across a vulnerability (inadvertently, of course), why don't we simply make it illegal to exploit the vulnerability?
- gmueckl 9y agoWait... all vulnerabilities are bugs and many bugs make software vulnerable in some way (even if not obvious at first). So where do you propose to draw the line between normal software QA (testing and bugfixing) and a hunt for vulnerabilities? My reading is that this would blatantly outlaw all forms of software testing.
- Ajedi32 9y agoGP is being sarcastic. Obviously outlawing finding and exploiting vulnerabilities in software would be useless (since black hats would ignore the rule) and actively harmful to the security of the modern software ecosystem (since white hats wouldn't).
- deleted 9y ago[deleted]
- torstenvl 9y agoIf discovering EME exploits is outlawed, only outlaws will discover EME exploits.
- imhoguy 9y agoIt is outlawed in US and possibly some other countries. But most of the World should be fine.
- yk 9y ago> If security researchers are (legally) prohibited from investigating EME technologies in browsers, then EME extensions become a big vector attack, and standards-compliant browsers that include them, become much less secure than browsers that don't. That is wrong (from the EME standard[0], section 10): > User Agent and Key System implementations MUST consider media data, Initialization Data, data passed to update(), licenses, key data, and all other data provided by the application as untrusted content and potential attack vectors. They MUST use appropriate safeguards to mitigate any associated threats and take care to safely parse, decrypt, etc. such data. User Agents SHOULD validate data before passing it to the CDM. That is, a browser has to be secure to implement the EME standard, if it is not secure it is not in compliance with EME! (Next up, anybody who falls from a building is in violation of the W3C gravity standard and as such flying is possible.) I trust I don't have to point out that I am joking. [0] https://www.w3.org/TR/encrypted-media/ https://www.w3.org/TR/encrypted-media/
- hmm_really 9y agoIts not W3C who produced the US law, is that so difficult to understand? If the US law changes, then the w3c standard still stands, I don't think anyone involved in W3C thinks preventing security researchers doing their job is a sensible thing. EFF are picking a fight with the wrong people, and producing propaganda to support that fight, making themselves less credible to those who actually understand the details. I know 'Fake News' is a popular thing in the US, but I don't think its a sensible tactic in the tech community.
- mljoe 9y agoThis isn't even theoretical! See the Sony rootkit DRM scandal. EME will almost certainly become an attack vector in the future.
- syrrim 9y agoIIRC EME is sandboxed, so you can't really expect any vulnerabilities in it to be exploitable. This is equivalent to complaining that sites you can visit can run arbitrary javascript. Security researchers neednt investigate the DRM itself, they can instead verify the sandbox.