10 ms·

Firefox’s adoption of closed-source DRM breaks my heart (2014)

82 points by jarsin 12y ago

wmf 12y ago
(2014) Although this is relevant again since they also decided to put DRM in Firefox OS for the Matchstick (curiously, the plan is Adobe DRM for desktop Firefox and Microsoft DRM for Matchstick; corrections/clarifications are welcome).
- azakai 12y ago
  Matchstick isn't a Mozilla project, is it? It happens to be built on Firefox OS code, but anyone can use that code, and Matchstick is made by a third party. Mozilla can't prevent someone from building a Firefox OS product and adding Microsoft DRM to it. So I think the "they" in your statement there might be confusing, as it seems to imply Mozilla is doing something here. (btw, I hadn't heard about this latest development with matchstick regarding Microsoft DRM, link?)
  - passwordreset 12y ago
    https://www.kickstarter.com/projects/matchstick/matchstick-the-streaming-stick-built-on-firefox-os/posts/1128155 https://www.kickstarter.com/projects/matchstick/matchstick-t... Update 16. It went out on Friday.
    - azakai 12y ago
      Thanks for the link. This is kind of surprising to me, that Microsoft would license PlayReady for a non-Microsoft platform, in this case Matchstick. I wonder if their policy was always that way, but it just didn't happen, or if it changed?
      - cpeterso 12y ago
        Microsoft wants its DRM to be supported on all platforms, otherwise it would irrelevant on mobile. PlayReady is available on Android, iOS, smart TVs, and set-top boxes (which most likely run Linux instead of Windows CE these days :) http://www.microsoft.com/playready/features/ http://www.microsoft.com/playready/features/
  - Manishearth 12y ago
    Firefox OS itself needs a lot of proprietary stuff (Drivers, etc), however. But meh, drivers.
  - cpeterso 12y ago
    Matchstick is not a Mozilla project. The Matchstick company has been (deliberately?) fast and loose with its marketing around Mozilla's and content providers' brand names. http://www.matchstick.tv/about/ http://www.matchstick.tv/about/
    - Caspy7 12y ago
      I've been rather irritated with the amount of sites reporting Matchstick as a Mozilla project, and again just recently. They did work with Mozilla early on to get casting running in Firefox Android to their prototype and it does have the "certified by Mozilla" label. Hopefully their efforts on MSE and EME will help expedite development in Firefox so that Youtube doesn't suck as much.
netflix_blows 12y ago
I expect this to be downvoted soon as the folks here plainly seem to prefer to be able to consume visual junk food via netflix rather than opt or push for open standards. Don't come crying back later when netfucks change the standards again, and the WC3 roll over and blindly accept it, and your computer becomes an expensive locked down media player.
- LukeB_UK 12y ago
  I downvoted your comment because of the non-constructive tone.
- silon5 12y ago
  DRM = SkyNet
- TylerE 12y ago
  A locked down media player is more useful than an open paperweight.
  - idlewan 12y ago
    An open media player is more useful than a locked down paperweight.
spankalee 12y ago
Except that Firefox does not include the closed source bits when distributed, and only downloads then on demand. If you don't watch DRM'ed content, you don't need closed source DRM, and once https://bugzilla.mozilla.org/show_bug.cgi?id=1089876 https://bugzilla.mozilla.org/show_bug.cgi?id=1089876 is fixed, you can disable EME altogether and ensure your installation's purity.
DCKing 12y ago
I don't understand how this is any worse than Firefox supporting (and reluctantly promoting) closed source plugins for years. In fact, this situation will be far better than Flash, Silverlight and all other plugins ever. Why is supporting EME and limiting closed source crapware to a minimum so bad, while supporting huge closed source, bug ridden application runtimes sort of okay?
- azakai 12y ago
  I think it's a valid point that EME reduces the amount of closed-source code. This was among the arguments used by Google and Microsoft when promoting EME. However, on the other hand: 1. EME is an actual W3C standard. It feels - and is - wrong for an organization like the W3C to promote an API that is not about openness, but rather about the opposite. 2. While EME proponents - and DRM proponents in general - argue "content makers will never accept delivery without DRM", that is far from clear. First, and most importantly, just a few months ago The Interview was sold online, without DRM whatsoever, and it made lots of money. The sky didn't fall. Second, the argument that "DRM is necessary" was also said about digital music, which eventually dropped DRM. Finally, there are also alternatives like watermarking (with their own downsides, to be sure) which over time could be explored. Overall, I think it is sad that Google, Microsoft and Netflix have won and EME is unavoidable at this point. But, given the power of those entities, only a miracle could have stopped it.
  - DCKing 12y ago
    Just for my context - is the browser plugin DOM interface used for plugins (the <object> tag) a W3C standard as well? I fully agree with point 2. Even if all browser vendors assumed this point to be true however, I think Netflix and other video content providers would have 'happily' run Flash and Silverlight for years and years. There hasn't been a shortage of browser DRM options for a very long time now. EME is an improvement over the Flash/Silverlight situation, and a realistic option at this point for improving the situation right now. It's a shame Firefox is being derided for being pragmatic or not being perfectly virtuous here. With implementing EME they are still working on improving the openness of the web.
AnthonyMouse 12y ago
There is an unintuitive takeaway from this. The reason Firefox is allowing this is that browsers and operating systems produced by nonprofits acting in the public interest don't have enough market share to resist being dictated to by for-profit corporations. Imagine FirefoxOS had the market share of Android and Debian had the market share of Windows. Would we still be having this conversation? The free software people have been preaching this for decades. It turns out they're right. So don't install Chrome, use Firefox. Then next time it will be easier for Mozilla to do the right thing.
- quonn 12y ago
  Firefox has improved a lot, since I switched to Chrome. What I'm waiting for is proper sandboxing using a multi-process architecture (they are working on it) and rubberband scrolling. Recently, Chrome has also improved profiles a lot, and I use that to isolate Facebook. I don't think Firefox has a comparable UI for this.
  - JupiterMoon 12y ago
    Firefox profiles allow this functionality simply type "firefox -ProfileManager" into your terminal...
    - TylerE 12y ago
      Functionality that involves invoking a command line for a web browser isn't.
      - JupiterMoon 12y ago
        Yeah the UI is clunky. They should make it easier to use. Try setting up an alias in your bashrc? If you really want to point-and-click just add the appropriate entries to your launcher/menu?
      - Caspy7 12y ago
        I'm not on Linux, but don't they allow you to create shortcuts with command line options like Windows?
jasonthevillain 12y ago
Well, I'm a 1. web developer, 2. independent filmmaker, and 3. work in media full-time, and this doesn't really bother me. I want to be able to rent any movie for streaming. For better or worse, that means some kind of DRM is inevitable. I'd rather Mozilla and the standards advocates have a seat at the table, where they can be a moderating influence, than pretend the table doesn't exist.
- iwwr 12y ago
  DRM isn't preventing people from pirating the works, it just makes life harder for paying customers and potentially presenting a security hole to them as well.
  - jasonthevillain 12y ago
    I don't disagree; the piracy firehose is already on and this is all a moot point. But if you want the distributors to play ball with web standards instead of sticking to Flash, you have to address their concerns.
- roblabla 12y ago
  Is DRM really inevitable for streaming video ? I can listen to my music as much as I want, unrestricted, without DRM, through deezer. And that's a premium service. They seem to be doing just fine. Besides, spotify uses flash for their webplayer, probably for DRM as well. Yet there exists an open source spotify client, despotify, that probably would make it very easy to download the music as MP3. In the end, DRM just means making your client's life a pain.
  - idlewan 12y ago
    What do you mean, without DRM? Does Deezer provide you with mp3 files to put on your devices (ipod shuffle or similar)? Can you send a file to a friend? Or does Deezer forces you to be online and/or use Deezer's own app to listen to your music? There are a lot of ways to engineer DRM in a system, I think you just don't see that you're actually using a DRMed system to play your music.
deleted 12y ago
[deleted]
cpeterso 12y ago
This is an interesting reframing of Cory Doctorow's position in his EFF post about YouTube last week. I assume the conversations with Mozilla's Mitchell Baker and Andreas Gal were arranged in response to the EFF piece. Is he playing "bad cop" on the EFF's site and "good cop" on the The Guardian?
Udo 12y ago
If this sandbox enables Firefox to safely host DRM malware, it could very well be used like a generic "Docker for the client", right? People could write high-performance code blobs in native chunks for things like online games, and Firefox would just load them without endangering the user's system or data. Maybe someone with in-depth knowledge of the sandbox could weigh in about its actual security, I'd be interested in hearing about it. Because if it's not secure enough to allow arbitrary code from random websites to execute safely, it's sure as hell not secure enough to run that DRM crap. What happens instead is Firefox becomes a vector for Trojan horses and root kits installable on my computer on behalf of any interest group imaginable. I switched from Chrome to Firefox specifically for things like these.
- maxerickson 12y ago
  I think native code sand boxing got to browsers before docker: https://developer.chrome.com/native-client https://developer.chrome.com/native-client
  - Udo 12y ago
    That's Chrome, does Firefox have anything like this? And if it does, why do we need an extra sandbox format for the DRM stuff again?
    - maxerickson 12y ago
      There was a big kertuffle a few years back where Mozilla made it clear they weren't going to support anything like native client (and they then put a bunch of resources into asm.js). I don't know if that has changed or not, I don't pay close attention. I only mentioned it because of the "Docker for the client" line, that it already exists is a pretty emphatic yes.
      - Udo 12y ago
        > I only mentioned it because of the "Docker for the client" line, You're right. I corrected the original comment to make it clearer I'm talking about Firefox. The point was to call out the sandbox argument a bit, since I'm not so sure it's actually safe to run malware in it.
_lce0 12y ago
it's time for a firefox fork

82 points by jarsin 12y ago

wmf 12y ago

(2014) Although this is relevant again since they also decided to put DRM in Firefox OS for the Matchstick (curiously, the plan is Adobe DRM for desktop Firefox and Microsoft DRM for Matchstick; corrections/clarifications are welcome).

azakai 12y ago
Matchstick isn't a Mozilla project, is it? It happens to be built on Firefox OS code, but anyone can use that code, and Matchstick is made by a third party. Mozilla can't prevent someone from building a Firefox OS product and adding Microsoft DRM to it. So I think the "they" in your statement there might be confusing, as it seems to imply Mozilla is doing something here. (btw, I hadn't heard about this latest development with matchstick regarding Microsoft DRM, link?)
- passwordreset 12y ago
  https://www.kickstarter.com/projects/matchstick/matchstick-the-streaming-stick-built-on-firefox-os/posts/1128155 https://www.kickstarter.com/projects/matchstick/matchstick-t... Update 16. It went out on Friday.
  - azakai 12y ago
    Thanks for the link. This is kind of surprising to me, that Microsoft would license PlayReady for a non-Microsoft platform, in this case Matchstick. I wonder if their policy was always that way, but it just didn't happen, or if it changed?
    - cpeterso 12y ago
      Microsoft wants its DRM to be supported on all platforms, otherwise it would irrelevant on mobile. PlayReady is available on Android, iOS, smart TVs, and set-top boxes (which most likely run Linux instead of Windows CE these days :) http://www.microsoft.com/playready/features/ http://www.microsoft.com/playready/features/
- Manishearth 12y ago
  Firefox OS itself needs a lot of proprietary stuff (Drivers, etc), however. But meh, drivers.
- cpeterso 12y ago
  Matchstick is not a Mozilla project. The Matchstick company has been (deliberately?) fast and loose with its marketing around Mozilla's and content providers' brand names. http://www.matchstick.tv/about/ http://www.matchstick.tv/about/
  - Caspy7 12y ago
    I've been rather irritated with the amount of sites reporting Matchstick as a Mozilla project, and again just recently. They did work with Mozilla early on to get casting running in Firefox Android to their prototype and it does have the "certified by Mozilla" label. Hopefully their efforts on MSE and EME will help expedite development in Firefox so that Youtube doesn't suck as much.

netflix_blows 12y ago

I expect this to be downvoted soon as the folks here plainly seem to prefer to be able to consume visual junk food via netflix rather than opt or push for open standards. Don't come crying back later when netfucks change the standards again, and the WC3 roll over and blindly accept it, and your computer becomes an expensive locked down media player.

LukeB_UK 12y ago
I downvoted your comment because of the non-constructive tone.
silon5 12y ago
DRM = SkyNet
TylerE 12y ago
A locked down media player is more useful than an open paperweight.
- idlewan 12y ago
  An open media player is more useful than a locked down paperweight.

spankalee 12y ago

Except that Firefox does not include the closed source bits when distributed, and only downloads then on demand. If you don't watch DRM'ed content, you don't need closed source DRM, and once https://bugzilla.mozilla.org/show_bug.cgi?id=1089876 https://bugzilla.mozilla.org/show_bug.cgi?id=1089876 is fixed, you can disable EME altogether and ensure your installation's purity.

DCKing 12y ago

I don't understand how this is any worse than Firefox supporting (and reluctantly promoting) closed source plugins for years. In fact, this situation will be far better than Flash, Silverlight and all other plugins ever. Why is supporting EME and limiting closed source crapware to a minimum so bad, while supporting huge closed source, bug ridden application runtimes sort of okay?

azakai 12y ago
I think it's a valid point that EME reduces the amount of closed-source code. This was among the arguments used by Google and Microsoft when promoting EME. However, on the other hand: 1. EME is an actual W3C standard. It feels - and is - wrong for an organization like the W3C to promote an API that is not about openness, but rather about the opposite. 2. While EME proponents - and DRM proponents in general - argue "content makers will never accept delivery without DRM", that is far from clear. First, and most importantly, just a few months ago The Interview was sold online, without DRM whatsoever, and it made lots of money. The sky didn't fall. Second, the argument that "DRM is necessary" was also said about digital music, which eventually dropped DRM. Finally, there are also alternatives like watermarking (with their own downsides, to be sure) which over time could be explored. Overall, I think it is sad that Google, Microsoft and Netflix have won and EME is unavoidable at this point. But, given the power of those entities, only a miracle could have stopped it.
- DCKing 12y ago
  Just for my context - is the browser plugin DOM interface used for plugins (the <object> tag) a W3C standard as well? I fully agree with point 2. Even if all browser vendors assumed this point to be true however, I think Netflix and other video content providers would have 'happily' run Flash and Silverlight for years and years. There hasn't been a shortage of browser DRM options for a very long time now. EME is an improvement over the Flash/Silverlight situation, and a realistic option at this point for improving the situation right now. It's a shame Firefox is being derided for being pragmatic or not being perfectly virtuous here. With implementing EME they are still working on improving the openness of the web.

AnthonyMouse 12y ago

There is an unintuitive takeaway from this. The reason Firefox is allowing this is that browsers and operating systems produced by nonprofits acting in the public interest don't have enough market share to resist being dictated to by for-profit corporations. Imagine FirefoxOS had the market share of Android and Debian had the market share of Windows. Would we still be having this conversation? The free software people have been preaching this for decades. It turns out they're right. So don't install Chrome, use Firefox. Then next time it will be easier for Mozilla to do the right thing.

quonn 12y ago
Firefox has improved a lot, since I switched to Chrome. What I'm waiting for is proper sandboxing using a multi-process architecture (they are working on it) and rubberband scrolling. Recently, Chrome has also improved profiles a lot, and I use that to isolate Facebook. I don't think Firefox has a comparable UI for this.
- JupiterMoon 12y ago
  Firefox profiles allow this functionality simply type "firefox -ProfileManager" into your terminal...
  - TylerE 12y ago
    Functionality that involves invoking a command line for a web browser isn't.
    - JupiterMoon 12y ago
      Yeah the UI is clunky. They should make it easier to use. Try setting up an alias in your bashrc? If you really want to point-and-click just add the appropriate entries to your launcher/menu?
    - Caspy7 12y ago
      I'm not on Linux, but don't they allow you to create shortcuts with command line options like Windows?

jasonthevillain 12y ago

Well, I'm a 1. web developer, 2. independent filmmaker, and 3. work in media full-time, and this doesn't really bother me. I want to be able to rent any movie for streaming. For better or worse, that means some kind of DRM is inevitable. I'd rather Mozilla and the standards advocates have a seat at the table, where they can be a moderating influence, than pretend the table doesn't exist.

iwwr 12y ago
DRM isn't preventing people from pirating the works, it just makes life harder for paying customers and potentially presenting a security hole to them as well.
- jasonthevillain 12y ago
  I don't disagree; the piracy firehose is already on and this is all a moot point. But if you want the distributors to play ball with web standards instead of sticking to Flash, you have to address their concerns.
roblabla 12y ago
Is DRM really inevitable for streaming video ? I can listen to my music as much as I want, unrestricted, without DRM, through deezer. And that's a premium service. They seem to be doing just fine. Besides, spotify uses flash for their webplayer, probably for DRM as well. Yet there exists an open source spotify client, despotify, that probably would make it very easy to download the music as MP3. In the end, DRM just means making your client's life a pain.
- idlewan 12y ago
  What do you mean, without DRM? Does Deezer provide you with mp3 files to put on your devices (ipod shuffle or similar)? Can you send a file to a friend? Or does Deezer forces you to be online and/or use Deezer's own app to listen to your music? There are a lot of ways to engineer DRM in a system, I think you just don't see that you're actually using a DRMed system to play your music.

deleted 12y ago

[deleted]

cpeterso 12y ago

This is an interesting reframing of Cory Doctorow's position in his EFF post about YouTube last week. I assume the conversations with Mozilla's Mitchell Baker and Andreas Gal were arranged in response to the EFF piece. Is he playing "bad cop" on the EFF's site and "good cop" on the The Guardian?

Udo 12y ago

If this sandbox enables Firefox to safely host DRM malware, it could very well be used like a generic "Docker for the client", right? People could write high-performance code blobs in native chunks for things like online games, and Firefox would just load them without endangering the user's system or data. Maybe someone with in-depth knowledge of the sandbox could weigh in about its actual security, I'd be interested in hearing about it. Because if it's not secure enough to allow arbitrary code from random websites to execute safely, it's sure as hell not secure enough to run that DRM crap. What happens instead is Firefox becomes a vector for Trojan horses and root kits installable on my computer on behalf of any interest group imaginable. I switched from Chrome to Firefox specifically for things like these.

maxerickson 12y ago
I think native code sand boxing got to browsers before docker: https://developer.chrome.com/native-client https://developer.chrome.com/native-client
- Udo 12y ago
  That's Chrome, does Firefox have anything like this? And if it does, why do we need an extra sandbox format for the DRM stuff again?
  - maxerickson 12y ago
    There was a big kertuffle a few years back where Mozilla made it clear they weren't going to support anything like native client (and they then put a bunch of resources into asm.js). I don't know if that has changed or not, I don't pay close attention. I only mentioned it because of the "Docker for the client" line, that it already exists is a pretty emphatic yes.
    - Udo 12y ago
      > I only mentioned it because of the "Docker for the client" line, You're right. I corrected the original comment to make it clearer I'm talking about Firefox. The point was to call out the sandbox argument a bit, since I'm not so sure it's actually safe to run malware in it.

_lce0 12y ago

it's time for a firefox fork