3 ms·

Winter is coming at Mozilla, but only because they've chosen to betray their community and adopt DRM, too.

Ygg2 12y ago
Riiight. Unlike other browser vendors with more than >5% marketshare, which all voted NO on DRM. Anyway the message is frivolous and OFF TOPIC.
- pjc50 12y ago
  Not entirely: the DRM code modules are necessarily closed-source and cannot easily be audited for security vulnerabilities. Given that Adobe is apparently supplying one, and given the number of remote exploits provided by the PDF reader plugin, I think it's reasonable to assume that the DRM modules can present a security risk.
  - pcwalton 12y ago
    The CDM is strictly sandboxed.
    - sp332 12y ago
      That's a good start, but it's not reason to implicitly trust that it can't break anything.
    - pjc50 12y ago
      So it's not native code? Interesting.
      - pcwalton 12y ago
        It's native code, but it's strictly contained within an open source sandbox that implements all the interfaces it can use to communicate with the outside world.
        justinschuh 12y ago
        Could you provide a link to the source for the sandbox implementation?
        pcwalton 12y ago
        I'm not on that team so I'll have to get back to you—it's quite possible that the code hasn't been written yet. Currently, we use the Chromium sandbox [1] for sandboxing where it's supported. [1]: http://mxr.mozilla.org/mozilla-central/source/security/sandbox/ http://mxr.mozilla.org/mozilla-central/source/security/sandb...
- nitrogen 12y ago
  This post could be an attempt to shift the narrative away from Mozilla's decision to include DRM, so the DRM issue at least deserves a mention, even if it sits at -4 at the bottom of the page. Somewhat relevant: http://www.paulgraham.com/submarine.html http://www.paulgraham.com/submarine.html
dang 12y ago
Please don't post off-topic diversions into political battles. The Mozilla/DRM issue has had extensive discussion in posts devoted to it.

Ygg2 12y ago

Riiight. Unlike other browser vendors with more than >5% marketshare, which all voted NO on DRM. Anyway the message is frivolous and OFF TOPIC.

pjc50 12y ago
Not entirely: the DRM code modules are necessarily closed-source and cannot easily be audited for security vulnerabilities. Given that Adobe is apparently supplying one, and given the number of remote exploits provided by the PDF reader plugin, I think it's reasonable to assume that the DRM modules can present a security risk.
- pcwalton 12y ago
  The CDM is strictly sandboxed.
  - sp332 12y ago
    That's a good start, but it's not reason to implicitly trust that it can't break anything.
  - pjc50 12y ago
    So it's not native code? Interesting.
    - pcwalton 12y ago
      It's native code, but it's strictly contained within an open source sandbox that implements all the interfaces it can use to communicate with the outside world.
      - justinschuh 12y ago
        Could you provide a link to the source for the sandbox implementation?
        pcwalton 12y ago
        I'm not on that team so I'll have to get back to you—it's quite possible that the code hasn't been written yet. Currently, we use the Chromium sandbox [1] for sandboxing where it's supported. [1]: http://mxr.mozilla.org/mozilla-central/source/security/sandbox/ http://mxr.mozilla.org/mozilla-central/source/security/sandb...
nitrogen 12y ago
This post could be an attempt to shift the narrative away from Mozilla's decision to include DRM, so the DRM issue at least deserves a mention, even if it sits at -4 at the bottom of the page. Somewhat relevant: http://www.paulgraham.com/submarine.html http://www.paulgraham.com/submarine.html

dang 12y ago

Please don't post off-topic diversions into political battles. The Mozilla/DRM issue has had extensive discussion in posts devoted to it.