4 ms·

> If the user visits such a site, Firefox will automatically download and install such a proprietary EME/CDM module. This presented a problem to us as we would

> If the user visits such a site, Firefox will automatically download and install such a proprietary EME/CDM module. This presented a problem to us as we would be dependent on those third-party vendors to publish ARM64 versions of those decoders. Wait, modern browsers still download and run native binaries at the request of certain sites? How is this different from the days when native plugins like Flash were massive security liabilities? I thought we didn't do that anymore?

Gaelan 6y ago
As I understand it, it's a single trusted binary (Google's Widevine), not arbitrary binaries from sites, so I doubt it's a huge security liability. Not to discount all the other problems with DRM on the web, of course.
- dblohm7 6y ago
  This is correct. These binaries are downloaded from specific update servers. EDIT: I stand corrected thanks to a colleague on the media team: the EME CDM update servers are known Google servers.
- padenot 6y ago
  The above is correct. The CDM is very heavily sandboxed, a signature is used, and therefore it can't really do anything apart from what it's supposed to do (which is very little, taking encoded data, a key, decode media). Source: I'm on that team, but I don't work directly on this.
- mortenjorck 6y ago
  Worth mentioning is that this is also solving a different problem from the old browser plugin ecosystem. Rather than enabling third parties to extend browser functionality, this exists exclusively to partition the open-source Firefox codebase from closed-source DRM code, a workaround to enable DRM playback in an open-source browser.
- azalemeth 6y ago
  This is correct. I still think the "best" answer is to untick the box that says "Play DRM Content" in the Firefox preference panes, and refuse to support corporations that would otherwise use it. I haven't bought DRM media for over fifteen years.
hoten 6y ago
The site is not making any such request, it is simply using a browser feature. The browser, on demand, downloads a known and trusted binary.
SulfurHexaFluri 6y ago
I wonder if this means there will finally be a way to use things like spotify and netflix on ARM linux machines.

Gaelan 6y ago

As I understand it, it's a single trusted binary (Google's Widevine), not arbitrary binaries from sites, so I doubt it's a huge security liability. Not to discount all the other problems with DRM on the web, of course.

dblohm7 6y ago
This is correct. These binaries are downloaded from specific update servers. EDIT: I stand corrected thanks to a colleague on the media team: the EME CDM update servers are known Google servers.
padenot 6y ago
The above is correct. The CDM is very heavily sandboxed, a signature is used, and therefore it can't really do anything apart from what it's supposed to do (which is very little, taking encoded data, a key, decode media). Source: I'm on that team, but I don't work directly on this.
mortenjorck 6y ago
Worth mentioning is that this is also solving a different problem from the old browser plugin ecosystem. Rather than enabling third parties to extend browser functionality, this exists exclusively to partition the open-source Firefox codebase from closed-source DRM code, a workaround to enable DRM playback in an open-source browser.
azalemeth 6y ago
This is correct. I still think the "best" answer is to untick the box that says "Play DRM Content" in the Firefox preference panes, and refuse to support corporations that would otherwise use it. I haven't bought DRM media for over fifteen years.

hoten 6y ago

The site is not making any such request, it is simply using a browser feature. The browser, on demand, downloads a known and trusted binary.

SulfurHexaFluri 6y ago

I wonder if this means there will finally be a way to use things like spotify and netflix on ARM linux machines.