8 ms·
Now Chrome disables Quicktime plugin by default
- moxiemk1 16y agoThough QuickTime is only an abstraction of OS provided codecs on Macs, this move once again brings up the question in me: Is there any valid technical reason for browsers to handle media files in any way other than wrapping OS provided codecs?
- blocke 16y agoAre you sure every codec on your system is kept up to date against the latest exploits? Every single one? Which is updated more often... Your browser or your codecs? Browsers are taking over certain functions because the OS side (both OS X and Windows) are a mess. I imagine it makes browsers easier to test too not having even more dependencies over the quirks of whatever dot release of the OS you are running.
- jws 16y agoBetter yet, why do my codecs have access to anything on my computer other than their input stream and output stream. They probably want to run on their own core anyway, isolate them and forget about them. (Ok, I'll give you an H.264 or MPEG-2 being tied into my video hardware for great performance and low power consumption, but the rest of them…)
- cube13 16y agoI'm going to only cover the desktop/laptop space. This approach actually makes a lot of sense in the smartphone/tablet market, especially with all the multi-core chips coming out. It's true that the bare minimum that a codec needs to do is take an input bytestream and output it to the various output(video and audio) bytestreams. So, for a hardware accelerated video, this is pretty simple-all you need to do is pipe your input stream to the hardware, and that will handle all the magic of getting it directly out to the screens and speakers. However, for non-native hardware accelerated codecs(i.e. not H.264 or MPEG-2), this process involves a lot more hardware and software to actually get something to the screen. The non-native hardware accelerated codecs need access to(at a bare minimum) the sound and video system APIs. Unless the codec developers are certifiably insane, the codec will be using DirectX(for Windows) or OpenGL(for everything else) to handle the actual writing to the screen, especially if you want to use the video hardware for faster decoding. While it's possible for browsers to wrap those API calls, it just makes a lot more effort on all developers involved, and doesn't really get you much security at the expense of both complexity and performance. So it makes sense for any codec to have access to the lower level APIs for displaying things to the screen. Sandboxing the process should be possible for the file inputs, but I'm not sure if it's really possible for file outputs in the cases where the codec is using a system-level API. EDIT: After reading what I wrote, this is a good argument for the browsers themselves wrapping the codecs and placing them into a sandbox. Unfortunately, that will never happen, because of the legal minefield that almost all have right now...
- nitrogen 16y agoActually, the codecs themselves usually aren't responsible for displaying to the screen via DirectX, OpenGL, etc. In the case of <video>, the browser needs to be able to mix the video into the web page, which means the browser needs the video data in its own memory, or as a pixmap/texture in video card memory. But, most codecs are going to be written in C and assembly language for speed, which brings the potential for buffer overflows and other low-level exploits. Plus, that video data does eventually make it to the kernel and then the video hardware (often via a separate overlay interface like DirectShow, Xv, or VDPAU, though that is probably not the case with web browsers), so a vulnerability at any point along the chain is a serious issue.
- antimatter15 16y agoSo they don't have to deal with inconsistent behaviors on different platforms. You can pretty much mess up your os installation anyway you would like, but bundling ffmpeg, libtheora or libvpx and you no longer need to worry about different platforms or configs
- CountSessine 16y agoThat converts a trivially solved technical problem into an insoluble political problem.
- wtallis 16y agoUnless you want hardware acceleration...
- sid0 16y agoWhat precludes bundled libraries from having support for hardware acceleration? Firefox 4 accelerates full-screen WebM videos on Windows and Mac, for instance.
- wtallis 16y agoYou need platform-specific APIs to give you direct access to the relevant hardware, which you then need to be able to use efficiently. I'd rather see applications just feed the bytestream to the OS to decode using the best means available, even if it means support for new codecs is a bit slow. (Although an OS-level codec plugin architecture like QuickTime Components can get you software decoding for new or obscure codecs.) If my GPU has a high-quality, high-speed H.264 decoder, I shouldn't have to worry about which browsers will use it. They should all default to the OS-provided decoding and playback methods unless there are sound technical reasons not to. If I want to use a new codec that's not supported by the fixed-function decoder, I shouldn't have to worry about which web browsers have bothered to include the necessary OpenCL code to decode on my GPU. I should just be able to install one codec that hooks in to the OS's media framework, and all browsers should use that first.
- sid0 16y agoIs there any valid technical reason for browsers to handle media files in any way other than wrapping OS provided codecs? See http://weblogs.mozillazine.org/roc/archives/2009/06/directshow_and.html http://weblogs.mozillazine.org/roc/archives/2009/06/directsh.... The philosophical reasons are even more important though.
- DarkShikari 16y agoSo that your browser vendor can force their philosophical decisions about file formats on their users. That's basically it. Security is supposedly an issue, but "clicking on a video file in your browser to play it" is no easier than clicking "open file" in a download prompt -- if there's a vulnerability in your media player, attackers don't need <video> to get to it.
- nitrogen 16y agoI think you may be slightly biased here :). A security exploit that requires clicking is a lot less serious than one that happens without user intervention. Since <video> and <object>/<embed> can play automatically, it makes sense to limit the tags' exposure to unknown code from the operating system's installed codecs.
- deleted 16y ago[deleted]
- bonaldi 16y ago(Bit of context: the Quicktime plugin now has to be enabled on every site you want to use it with; there's no global way around it. Comes in wake of Google's dumping of h.264, which Quicktime handles natively).
- drivebyacct2 16y agoSurely you're not implying that Google is pushing out Quicktime because they don't want h264 support provided by 3rd parties. That's ridiculous, especially since all versions of Chrome shipping still have h264 support. That would be a bit horse before the carriage.
- StavrosK 16y ago> That would be a bit horse before the carriage. So, the way it's supposed to be?
- nextparadigms 16y agoWhat all versions of Chrome? Chrome auto-updates so the vast majority if not all of them are on the latest version (or newer beta versions) which is Chrome 10. And Chrome 10 doesn't have h.264 support built-in anymore.
- protomyth 16y agoThis pretty much means I am going to have to delete Chrome from all the machines and either use IE / Safari, put Safari on the Windows boxes, or go with Firefox (and hope they don't pull the same stunt). H.264 is used for teaching material and I would like to use one browser on both platforms. No, I will not login to every new account and setup specific sites to set as "safe".
- deleted 16y ago[deleted]
- drivebyacct2 16y ago
- WiseWeasel 16y agoIt's OK because proprietary plugins like QuickTime are a threat to the open web, and should be eliminated according to Steve Jobs (who I always turn to for moral guidance on the use of open vs. proprietary systems): "... we strongly believe that all standards pertaining to the web should be open." http://www.apple.com/hotnews/thoughts-on-flash/ http://www.apple.com/hotnews/thoughts-on-flash/
- davidedicillo 16y agoYeah, not like the famously open Adobe Flash.
- Recoil42 16y agoYou mean this one? http://techcrunch.com/2008/04/30/adobes-open-screen-project-write-once-flash-everywhere/ http://techcrunch.com/2008/04/30/adobes-open-screen-project-... http://www.adobe.com/devnet/swf.html http://www.adobe.com/devnet/swf.html http://www.adobe.com/devnet/f4v.html http://www.adobe.com/devnet/f4v.html
- bogomips 16y agoI see you got downvoted. HN has descended into a pro-Apple prattle pit yet again, which is sad.
- recoiledsnake 16y agoYet again? You mean there was some time when it wasn't? I missed it.
- WiseWeasel 16y agoOpen Screen is a trojan horse to make Flash the standard development API for TV sets (leaving everyone dependent on Adobe's professional tools to create the content for these devices). SWF and F4V container formats are indeed published freely, however the Flash runtime itself is still proprietary, and thus incompatible with an open web.
- amattn 16y agoMaybe it's just me, but how can you embrace Flash but not Quicktime without looking like a hypocrite?
- bogomips 16y ago? Not a fan of Flash, but video-playback is a very, very small part of the Flash platform (and even then it's often producer-friendly in the form of supporting extensive DRM for the illusion of content control), while it is virtually all of QuickTime. QuickTime is completely obsolete. Flash is just mostly obsolete.
- chc 16y agoI'm confused. Are you saying video playback is obsolete, or was there some new video playback library with similar breadth to QuickTime that I didn't know about which as rendered it obsolete?
- bogomips 16y agoQuickTime is terribly obsolete, joining the ranks of products like RealPlayer. It has no reason to exist in the modern platform. http://www.apple.com/ipad/guided-tours/ http://www.apple.com/ipad/guided-tours/ On h264/Ogg/webM capable browsers, I'm told to download and install QuickTime. If we want to talk about hypocrisy, it starts there.
- chc 16y agoRealPlayer was a program and browser plugin focused around one proprietary format. QuickTime is an A/V library supporting a wide array of codecs — it's the standard way to play video on the Mac. If it's obsolete, then what is the replacement?
- yuhong 16y agoHTML5 video, I think. Even Apple is no longer promoting the QuickTime plug-in.
- peregrine 16y agoThey also disable Java by default in the nighties. Lifesaver.
- blocke 16y agoThis. So incredibly this. I love this damn feature and now that it's here I'm going to be impatient with any browser that doesn't. I can now feel safe leaving Java turned on.
- peregrine 16y agoThe only issue with it so far and I haven't submitted a bug report yet is that it slides the entire page down without turning on the scroll. So pages like gmail end up losing the chat and tasks.
- mapgrep 16y agoAround the time this was posted to HN, Stuart Morgan of Google and the Chromium project added a comment to the bug report that "this is a security feature that is applied to certain specific plugins even when they are up to date." http://code.google.com/p/chromium/issues/detail?id=78768#c1 http://code.google.com/p/chromium/issues/detail?id=78768#c1 [speculation] Maybe it's to do with this, patched in a new OS X release only a couple of weeks ago? "An integer overflow existed in QuickTime's handling of movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. " http://www.net-security.org/secworld.php?id=10770 http://www.net-security.org/secworld.php?id=10770 [/speculation]
- blocke 16y agoAs someone who uses Chrome under Mac, Windows and Linux I applaud this move. The Quicktime plugin on Windows is HORRID. It is a prime example of how to make a user experience complete shit. And to be honest I'd prefer the Mac version not pull it in automatically either. Weither it's the crashing, slow startup times, bazaar buffering behavior or taking over way too many MIME types I hate it. I strongly prefer that Chrome asked my permission before executing either the Quicktime or Java plugins just like it prompts for popups. All are annoying, buggy, laggy and crashy. Both Quicktime and Java were manually disabled globally on every browser I use and now I can feel safe leaving them on. This change makes my web browsing experience SAFER and less frustrating. Of course my dream is never to have to touch QuickTime or that horrid Apple Update garbage on Windows ever again. I'm not buying a Mac for home because Apple can't be trusted around VisualStudio. Flash gets the pass because Adobe lets Google worry about making sure updates are available on day 1. Odds of Google and Apple working together on Quicktime... Haha... haha... ha.
- bdhe 16y agoOT, but > ... bazaar buffering behavior ... should read "... bizarre buffering behavior ...". Bazaar is a word with a Persian etymology that refers to a market.
- jamaicahest 16y agoQT on Windows is horrible, but disabling it outright and requiring users to start Chrome with a custom commandline, without warning and after an automatic (and hidden) update? Let's just say it did not go down well at work, where we use Chrome and QT for inhouse enterprise applications. I understand the need to push the envelope on web standards and that needs to happen at a rapid pace, but at least give us enterprise developers a chance to override it. Enterprises do not develop software at breakneck speed Google, it's just not worth it.
- oemera 16y agoWait. Why is the user losing the most in such political desicisons? I can't believe that. I love the Chrome browser but that's to much. I mean come on QuickTime (on the Mac) is the least painful player. In addition I have to say that I'm a MacBook Air user that means when I play flash content in the chrome browser my fan is freaking out. With QuickTime this doesnt happen and guess what I like more? Yes, playing videos without freaking out fans.
- kmfrk 16y agoApple's gift to mankind was to ban(ish) Flash. Facebook's was to ban(ish) QuickTime. QuickTime feels like something that should have gone the way of the dodos, back when RealPlayer disappeared into obscurity. After RealPlayer, QuickTime became the worst software experience on Windows. (iTunes comes in right after.)
- deleted 16y ago[deleted]
- calloc 16y agoHow did Facebook banish QuickTime?
- freddier 16y agoHTML5 video won't work in Safari for Windows unless you also have Quicktime installed.
- lopatamd 16y agohuh nice.. never used quicktime anyways
- deleted 16y ago[deleted]
- yuhong 16y agoWhat is more desperately needed thanks to the Flash 0-day exploits flying around is for MS to add something similar to Office. I'm sure most people don't embed Flash in Office documents.
- othermaciej 16y agoChrome is currently the crashiest app on Lion seed builds (yes, even more than browsers that have more users on Mac). Maybe it should disable itself?