3 ms·

I think it's a case of pushing at the margin; exposing more details of the CDM plugins than would otherwise be exposed. Opening the CDM spec is also a design wi

I think it's a case of pushing at the margin; exposing more details of the CDM plugins than would otherwise be exposed. Opening the CDM spec is also a design win for reasons that should be obvious to people who've worked on software. It's been the general trend in web browsers to minimize the permissions you need to give to plugins--I would expect CDM plugins to evolve the same way.

mwcampbell 13y ago
You may be right about minimizing the permissions given to CDM plugins. In the current Chrome dev build, the Widevine CDM plugin is a Pepper plugin, which suggests that it might be sandboxed. However, DRM has sometimes been very over-reaching. Perhaps the most infamous example of this was the content protection introduced in Windows Vista, which went very deep into the OS. [1] After that, can we really expect that DRM proponents would be satisfied with letting their content "protection" system be a well-behaved, harmless little program inside a sandbox? [1] http://www.cs.auckland.ac.nz/~pgut001/pubs/vista_cost.html http://www.cs.auckland.ac.nz/~pgut001/pubs/vista_cost.html
- greggman 13y ago
  Being a Pepper plugin doesn't help at all. It's still a black box. It still has full access to your machine. It can not be sandboxed because it's up to the CDM to decide how to validate and how deep to connect to the machine. The CDM will want to control the bits from the time they get delivered to the CDM from the browser, all the way to the monitor with whatever tech the CDM author feels like employing. Chrome can not validate the code nor the inputs to the code. It's a giant security hole. For all you know some CDM will just implement the blu-ray standard, Java and all. Yep, unsecured code execution.
belorn 13y ago
> It's been the general trend in web browsers to minimize the permissions you need to give to plugins--I would expect CDM plugins to evolve the same way. DRM need control over the computer for it to ever do anything. Trying to sandbox DRM, is like trying to sandbox anti-virus software. It can't happen, and has never happened before.

mwcampbell 13y ago

You may be right about minimizing the permissions given to CDM plugins. In the current Chrome dev build, the Widevine CDM plugin is a Pepper plugin, which suggests that it might be sandboxed. However, DRM has sometimes been very over-reaching. Perhaps the most infamous example of this was the content protection introduced in Windows Vista, which went very deep into the OS. [1] After that, can we really expect that DRM proponents would be satisfied with letting their content "protection" system be a well-behaved, harmless little program inside a sandbox? [1] http://www.cs.auckland.ac.nz/~pgut001/pubs/vista_cost.html http://www.cs.auckland.ac.nz/~pgut001/pubs/vista_cost.html

greggman 13y ago
Being a Pepper plugin doesn't help at all. It's still a black box. It still has full access to your machine. It can not be sandboxed because it's up to the CDM to decide how to validate and how deep to connect to the machine. The CDM will want to control the bits from the time they get delivered to the CDM from the browser, all the way to the monitor with whatever tech the CDM author feels like employing. Chrome can not validate the code nor the inputs to the code. It's a giant security hole. For all you know some CDM will just implement the blu-ray standard, Java and all. Yep, unsecured code execution.

belorn 13y ago

> It's been the general trend in web browsers to minimize the permissions you need to give to plugins--I would expect CDM plugins to evolve the same way. DRM need control over the computer for it to ever do anything. Trying to sandbox DRM, is like trying to sandbox anti-virus software. It can't happen, and has never happened before.