4 ms·

It definitely is in a tightly locked cage. Firefox even generates the device fingerprint itself rather than allow any machine access. An EME module cannot acces

It definitely is in a tightly locked cage. Firefox even generates the device fingerprint itself rather than allow any machine access. An EME module cannot access the Internet, nor store data to the hard drive. There's a detailed writeup here: https://hacks.mozilla.org/2014/05/reconciling-mozillas-mission-and-w3c-eme/ https://hacks.mozilla.org/2014/05/reconciling-mozillas-missi...

belorn 12y ago
An interesting technical claim to sandbox a process in such a way that it has free access to display drivers and hardware modules (tpm's) but not the host system, network or hard drive. I would like to see a security audit on that claim.
- ianlevesque 12y ago
  I'm no expert on the Firefox source code but it appears the relevant code is here https://hg.mozilla.org/mozilla-central/file/193c4c5c7ec2/media/gmp-clearkey/0.1 https://hg.mozilla.org/mozilla-central/file/193c4c5c7ec2/med...
SixSigma 12y ago
This is a bad thing. No saving means : No time shifting, no device shifting, no legal fair use.
- DougBTX 12y ago
  Exaggerating claims beyond a certain point makes them unconvincing. For example, the BBC's iPlayer is designed for time shifting and device shifting, and it has always used restrictive DRM, so saying that DRM prevents that just makes the argument look wrong to semi-informed users.
  - falcolas 12y ago
    > saying that DRM prevents that just makes the argument look wrong to semi-informed users. It does prevent these uses, however, unless the content provider explicitly provides it. The US law says that the content provider does not need to explicitly allow it; it's a right granted to the user by copyright law.
  - deleted 12y ago
    [deleted]
  - SixSigma 12y ago
    > For example, the BBC's iPlayer is designed for time shifting and device shifting Cool, can you show me how to play the content on my portable MP4 player please.
    - JupiterMoon 12y ago
      get-iplayer?
      - gergles 12y ago
        Which relies on the flash streaming protocol, so here we are back at square one.
        JupiterMoon 12y ago
        Actually we're worse. As I understand it UK law considers that because flash based DRM is weak it doesn't count as DRM and hence get-iplayer is legal. Will this hold when/if the BBC switches to the new boss?
        M2Ys4U 12y ago
        >As I understand it UK law considers that because flash based DRM is weak it doesn't count as DRM Unfortunately, no. I think you may be getting tripped up by the phrase "effective technological measures" - being "effective" is a very, very low bar. To quote s296ZF of the Copyright, Designs and Patents Act 1988:[0] “technological measures” are any technology, device or component which is designed, in the normal course of its operation, to protect a copyright work other than a computer program. (2)Such measures are “effective” if the use of the work is controlled by the copyright owner through— (a)an access control or protection process such as encryption, scrambling or other transformation of the work, or (b)a copy control mechanism, which achieves the intended protection. [0] http://www.legislation.gov.uk/ukpga/1988/48/section/296ZF http://www.legislation.gov.uk/ukpga/1988/48/section/296ZF
      - SixSigma 12y ago
        I searched the BBC website but I can't find that anywhere.
- mccr8 12y ago
  I'd guess that the larger barrier to the lack of saving is the desires of the copyright holders who decide what the EME module can do, rather than the permissiveness of the sandbox.

belorn 12y ago

An interesting technical claim to sandbox a process in such a way that it has free access to display drivers and hardware modules (tpm's) but not the host system, network or hard drive. I would like to see a security audit on that claim.

ianlevesque 12y ago
I'm no expert on the Firefox source code but it appears the relevant code is here https://hg.mozilla.org/mozilla-central/file/193c4c5c7ec2/media/gmp-clearkey/0.1 https://hg.mozilla.org/mozilla-central/file/193c4c5c7ec2/med...

SixSigma 12y ago

This is a bad thing. No saving means : No time shifting, no device shifting, no legal fair use.

DougBTX 12y ago
Exaggerating claims beyond a certain point makes them unconvincing. For example, the BBC's iPlayer is designed for time shifting and device shifting, and it has always used restrictive DRM, so saying that DRM prevents that just makes the argument look wrong to semi-informed users.
- falcolas 12y ago
  > saying that DRM prevents that just makes the argument look wrong to semi-informed users. It does prevent these uses, however, unless the content provider explicitly provides it. The US law says that the content provider does not need to explicitly allow it; it's a right granted to the user by copyright law.
- deleted 12y ago
  [deleted]
- SixSigma 12y ago
  > For example, the BBC's iPlayer is designed for time shifting and device shifting Cool, can you show me how to play the content on my portable MP4 player please.
  - JupiterMoon 12y ago
    get-iplayer?
    - gergles 12y ago
      Which relies on the flash streaming protocol, so here we are back at square one.
      - JupiterMoon 12y ago
        Actually we're worse. As I understand it UK law considers that because flash based DRM is weak it doesn't count as DRM and hence get-iplayer is legal. Will this hold when/if the BBC switches to the new boss?
        M2Ys4U 12y ago
        >As I understand it UK law considers that because flash based DRM is weak it doesn't count as DRM Unfortunately, no. I think you may be getting tripped up by the phrase "effective technological measures" - being "effective" is a very, very low bar. To quote s296ZF of the Copyright, Designs and Patents Act 1988:[0] “technological measures” are any technology, device or component which is designed, in the normal course of its operation, to protect a copyright work other than a computer program. (2)Such measures are “effective” if the use of the work is controlled by the copyright owner through— (a)an access control or protection process such as encryption, scrambling or other transformation of the work, or (b)a copy control mechanism, which achieves the intended protection. [0] http://www.legislation.gov.uk/ukpga/1988/48/section/296ZF http://www.legislation.gov.uk/ukpga/1988/48/section/296ZF
    - SixSigma 12y ago
      I searched the BBC website but I can't find that anywhere.
mccr8 12y ago
I'd guess that the larger barrier to the lack of saving is the desires of the copyright holders who decide what the EME module can do, rather than the permissiveness of the sandbox.