4 ms·

I’m not claiming the situation is just or should be ignored, but the option the author seems to be ignoring is to launch without Widevine. Sure, a lot won’t wor

I’m not claiming the situation is just or should be ignored, but the option the author seems to be ignoring is to launch without Widevine. Sure, a lot won’t work, but a lot will. Having a vocal community can add a lot of pressure.

sneak 6y ago
They could also reverse engineer the Widevine module binary and reimplement it in their own project. You don't really need Google for this.
- gu5 6y ago
  And then get a DMCA request which takes down your Github repo.
- swiftcoder 6y ago
  This is, unfortunately, explicitly made illegal by the DCMA Anti-Circumvention Provisions.
  - anthk 6y ago
    DMCA has interoperatibility exceptions.
    - SubiculumCode 6y ago
      Better have a good team of lawyers though.
      - anthk 6y ago
        IBM PC BIOS case as a previous basis.
        SubiculumCode 6y ago
        and boy did IBM try to bring in the heavy lawyer guns on that case, didn't they.
- danogentili 6y ago
  Or literally use the header files for the widevine blobs freely available in the chromium sources to directly use the API exported by the .so... ... and then get sued for illegally calling a few exported methods on a shared library you freely downloaded from the internet (but without first obtaining a license from Google!). And by the way, I wasn't kidding about the freely downloadable from the internet part, when you open Netflix in Firefox, the browser downloads and loads a shared library from a Google domain: https://dl.google.com/widevine-cdm/${WIDEVINE_VERSION}-linux-${WIDEVINE_ARCH}.zip https://dl.google.com/widevine-cdm/${WIDEVINE_VERSION}-linux... As per https://gist.github.com/ruario/3c873d43eb20553d5014bd4d29fe37f1 https://gist.github.com/ruario/3c873d43eb20553d5014bd4d29fe3..., which is still used by certain browsers and unofficial clients like the inputstream kodi extension to play netflix videos. If you're on arm, an entire chrome OS image is downloaded instead, extracting the compiled widevine shared library.
- tbodt 6y ago
  Aside from being illegal, defeating the various layers of obfuscation and extracting the private keys requires a very particular set of skills, beyond the reach of most programmers. And then they'll just rotate the key and add more obfuscation, once they're done suing you out of existence.
  - sneak 6y ago
    Reverse engineering publicly available proprietary software distributed as freeware to reimplement free software replacements is not illegal.
    - tbodt 6y ago
      Can you help convince me of this? Also I'd encourage you to contact the owners of the repositories listed in Google's DMCA notice against the Widevine cryptographic key and help them file a counter-notice. https://github.com/github/dmca/blob/master/2020/11/2020-11-09-Google.md https://github.com/github/dmca/blob/master/2020/11/2020-11-0...
hirundo 6y ago
The point of his browser is to be able to playback Netflix, Hulu, etc. between browsers in sync. That can't be done without DRM, and Widevine is "the only available DRM for a Chromium-based browser, especially so for Electron."
- MaxBarraclough 6y ago
  I believe that's mistaken. From the article: > As far as I’m aware, Widevine is the only available DRM for a Chromium-based browser, especially so for Electron. But according to this [0] the Chromium-based Edge browser supports both Google's WideVine CDM and Microsoft's PlayReady CDM. Not sure if it's really any help, but that's a different question. [0] https://github.com/google/shaka-player/issues/2492#issuecomment-611242999 https://github.com/google/shaka-player/issues/2492#issuecomm...
  - smaddock 6y ago
    At the time of the article, Chromium Edge hadn't been released yet with PlayReady CDM integrated. The followup article I wrote elaborates on these options further. https://blog.samuelmaddock.com/posts/the-end-of-indie-web-browsers/ https://blog.samuelmaddock.com/posts/the-end-of-indie-web-br...
coldtea 6y ago
Yeah, but it's not a browser, it's a glorified media player. Basically the dev wanted to take Electron (a wrapper of Chromium/v8, the Google maintained FOSS browser engine) + Google's Widevine, smash them together with some glue code and a special-purpose UI, and call it a "broswer".
- smaddock 6y ago
  Brave also started out this way—building a browser on top of Electron. [0] Building something on top of the Chromium project is still building a browser. You're right that it's not building a rendering engine and JavaScript interpreter though. [0] https://github.com/brave/browser-laptop https://github.com/brave/browser-laptop
  - eivarv 6y ago
    ... and Brave famously migrated away from building a browser using Electron, because of the security-implications (not to mention that Electron actively discourages it). Building something on top of the Chromium project is pretty different than using and embedded version of its web engine. In the case of a high-impact vulnerability, for instance, the time between committing a fix in Chromium and the user having an updated browser is obviously shorter than committing a fix in Chromium and making a release, waiting for the framework embedding Blink to update it's embedded engine and make a release, waiting for a "browser" built using an embedded framework to update its dependencies (including the new version of embedded framework) and pushing a new release to end users.
    - danShumway 6y ago
      > and Brave famously migrated away from building a browser using Electron Is that relevant? Do you think that Google was going to refuse to license Widevine and then Brave made the migration to CEF and they said, "now we know you're serious"? It's not user security that's causing Google to refuse to license Widevine to this project. The response Google gives is not, "I'm sorry but we're not supporting an Electron solution like this", it's "I'm sorry but we're not supporting an Open Source solution like this." In fact, if you read the full email exchange, the suggestion that the Widevine licensing team gives is to move to a proprietary Electron fork that will be even slower to receive security patches than the upstream codebase would be. So it's definitely not the Electron/security part that Google is upset about.

sneak 6y ago

They could also reverse engineer the Widevine module binary and reimplement it in their own project. You don't really need Google for this.

gu5 6y ago
And then get a DMCA request which takes down your Github repo.
swiftcoder 6y ago
This is, unfortunately, explicitly made illegal by the DCMA Anti-Circumvention Provisions.
- anthk 6y ago
  DMCA has interoperatibility exceptions.
  - SubiculumCode 6y ago
    Better have a good team of lawyers though.
    - anthk 6y ago
      IBM PC BIOS case as a previous basis.
      - SubiculumCode 6y ago
        and boy did IBM try to bring in the heavy lawyer guns on that case, didn't they.
danogentili 6y ago
Or literally use the header files for the widevine blobs freely available in the chromium sources to directly use the API exported by the .so... ... and then get sued for illegally calling a few exported methods on a shared library you freely downloaded from the internet (but without first obtaining a license from Google!). And by the way, I wasn't kidding about the freely downloadable from the internet part, when you open Netflix in Firefox, the browser downloads and loads a shared library from a Google domain: https://dl.google.com/widevine-cdm/${WIDEVINE_VERSION}-linux-${WIDEVINE_ARCH}.zip https://dl.google.com/widevine-cdm/${WIDEVINE_VERSION}-linux... As per https://gist.github.com/ruario/3c873d43eb20553d5014bd4d29fe37f1 https://gist.github.com/ruario/3c873d43eb20553d5014bd4d29fe3..., which is still used by certain browsers and unofficial clients like the inputstream kodi extension to play netflix videos. If you're on arm, an entire chrome OS image is downloaded instead, extracting the compiled widevine shared library.
tbodt 6y ago
Aside from being illegal, defeating the various layers of obfuscation and extracting the private keys requires a very particular set of skills, beyond the reach of most programmers. And then they'll just rotate the key and add more obfuscation, once they're done suing you out of existence.
- sneak 6y ago
  Reverse engineering publicly available proprietary software distributed as freeware to reimplement free software replacements is not illegal.
  - tbodt 6y ago
    Can you help convince me of this? Also I'd encourage you to contact the owners of the repositories listed in Google's DMCA notice against the Widevine cryptographic key and help them file a counter-notice. https://github.com/github/dmca/blob/master/2020/11/2020-11-09-Google.md https://github.com/github/dmca/blob/master/2020/11/2020-11-0...

hirundo 6y ago

The point of his browser is to be able to playback Netflix, Hulu, etc. between browsers in sync. That can't be done without DRM, and Widevine is "the only available DRM for a Chromium-based browser, especially so for Electron."

MaxBarraclough 6y ago
I believe that's mistaken. From the article: > As far as I’m aware, Widevine is the only available DRM for a Chromium-based browser, especially so for Electron. But according to this [0] the Chromium-based Edge browser supports both Google's WideVine CDM and Microsoft's PlayReady CDM. Not sure if it's really any help, but that's a different question. [0] https://github.com/google/shaka-player/issues/2492#issuecomment-611242999 https://github.com/google/shaka-player/issues/2492#issuecomm...
- smaddock 6y ago
  At the time of the article, Chromium Edge hadn't been released yet with PlayReady CDM integrated. The followup article I wrote elaborates on these options further. https://blog.samuelmaddock.com/posts/the-end-of-indie-web-browsers/ https://blog.samuelmaddock.com/posts/the-end-of-indie-web-br...

coldtea 6y ago

Yeah, but it's not a browser, it's a glorified media player. Basically the dev wanted to take Electron (a wrapper of Chromium/v8, the Google maintained FOSS browser engine) + Google's Widevine, smash them together with some glue code and a special-purpose UI, and call it a "broswer".

smaddock 6y ago
Brave also started out this way—building a browser on top of Electron. [0] Building something on top of the Chromium project is still building a browser. You're right that it's not building a rendering engine and JavaScript interpreter though. [0] https://github.com/brave/browser-laptop https://github.com/brave/browser-laptop
- eivarv 6y ago
  ... and Brave famously migrated away from building a browser using Electron, because of the security-implications (not to mention that Electron actively discourages it). Building something on top of the Chromium project is pretty different than using and embedded version of its web engine. In the case of a high-impact vulnerability, for instance, the time between committing a fix in Chromium and the user having an updated browser is obviously shorter than committing a fix in Chromium and making a release, waiting for the framework embedding Blink to update it's embedded engine and make a release, waiting for a "browser" built using an embedded framework to update its dependencies (including the new version of embedded framework) and pushing a new release to end users.
  - danShumway 6y ago
    > and Brave famously migrated away from building a browser using Electron Is that relevant? Do you think that Google was going to refuse to license Widevine and then Brave made the migration to CEF and they said, "now we know you're serious"? It's not user security that's causing Google to refuse to license Widevine to this project. The response Google gives is not, "I'm sorry but we're not supporting an Electron solution like this", it's "I'm sorry but we're not supporting an Open Source solution like this." In fact, if you read the full email exchange, the suggestion that the Widevine licensing team gives is to move to a proprietary Electron fork that will be even slower to receive security patches than the upstream codebase would be. So it's definitely not the Electron/security part that Google is upset about.