5 ms·

I could have written this word-for-word. I am curious if asm.js is quick enough to produce code that could decode encrypted full-screen HD video on browsers wh

I could have written this word-for-word. I am curious if asm.js is quick enough to produce code that could decode encrypted full-screen HD video on browsers whose vendors won't support the media extensions. Pardon me for ignorance on this subject, but is there something about DRM that requires a plugin or component built into the browser itself? Could our answer to Netflix be, "Write the codec yourself using asm.js"?

wmf 13y ago
JS codecs are possible: https://news.ycombinator.com/item?id=5653531 https://news.ycombinator.com/item?id=5653531 I don't know whether Hollywood would consider JS DRM secure enough; it probably depends how good a negotiator you are.
taopao 13y ago
DRM isn't possible without cooperation with a "trusted" component. If the decoding is happening in an environment that is available for introspection (e.g. Javascript runtime) then you can trivially tee the decoded bits after they are decrypted.-
EdSharkey 13y ago
@taopao, And for a component to be "trusted" it has to be code that was loaded with the operating system, or in this case, the operating environment (the browser)? It seems to me that quashing tampering or observing of the trusted component is the lynchpin. In JavaScript, there is no way to access unexposed internals of an IIFE, that seems to me to get us half way there. I wonder if there could be some way to add a "use trusted" pragma to an IIFE such that the browser would not allow debugging or watching the network traffic of that code? There'd have to be some new way to compare a checksum of the trusted code as well. I suppose that that could suffice in a video watermarking scenario, but Netflix could never watermark each and every video transmitted. I think they partner with some ISP's to cache content near to the users as well, so they're not even responsible for broadcasting the last mile of the video.
- whitehat2k9 13y ago
  But it's only a matter of time before someone hacks their browser to ignore those directives.
  - EdSharkey 13y ago
    This is true, but for the vast majority of consumers would supporting a trusted block of javascript be good enough? All the movie industry wants is to make sure that Joe Sixpack cant get a digital copy of the data stream. I know I am sortof commandeering the word "trusted" for something much weaker than what I think industry wants it to be here, I realize that. Maybe using such a term in a weak solution would satisfy the pointy haired bosses of the world. >:) Seems to me if some rogue binary goes in and tampers with my Firefox or Chrome binary in order to circumvent browser security, then the browsers would know it and fail with an error. Obviously, any browser that builds from source can be directly modified by a developer.

wmf 13y ago

JS codecs are possible: https://news.ycombinator.com/item?id=5653531 https://news.ycombinator.com/item?id=5653531 I don't know whether Hollywood would consider JS DRM secure enough; it probably depends how good a negotiator you are.

taopao 13y ago

DRM isn't possible without cooperation with a "trusted" component. If the decoding is happening in an environment that is available for introspection (e.g. Javascript runtime) then you can trivially tee the decoded bits after they are decrypted.-

EdSharkey 13y ago

@taopao, And for a component to be "trusted" it has to be code that was loaded with the operating system, or in this case, the operating environment (the browser)? It seems to me that quashing tampering or observing of the trusted component is the lynchpin. In JavaScript, there is no way to access unexposed internals of an IIFE, that seems to me to get us half way there. I wonder if there could be some way to add a "use trusted" pragma to an IIFE such that the browser would not allow debugging or watching the network traffic of that code? There'd have to be some new way to compare a checksum of the trusted code as well. I suppose that that could suffice in a video watermarking scenario, but Netflix could never watermark each and every video transmitted. I think they partner with some ISP's to cache content near to the users as well, so they're not even responsible for broadcasting the last mile of the video.

whitehat2k9 13y ago
But it's only a matter of time before someone hacks their browser to ignore those directives.
- EdSharkey 13y ago
  This is true, but for the vast majority of consumers would supporting a trusted block of javascript be good enough? All the movie industry wants is to make sure that Joe Sixpack cant get a digital copy of the data stream. I know I am sortof commandeering the word "trusted" for something much weaker than what I think industry wants it to be here, I realize that. Maybe using such a term in a weak solution would satisfy the pointy haired bosses of the world. >:) Seems to me if some rogue binary goes in and tampers with my Firefox or Chrome binary in order to circumvent browser security, then the browsers would know it and fail with an error. Obviously, any browser that builds from source can be directly modified by a developer.