General sandboxing is being worked on but it is a complex problem.
1 Like
Citation needed.
You do realize that this only happens if users allow it or perhaps want it. I know it is a stretch for some folks here but a lot of folks want to stream current TV and movie content and pay services for this privilege. These services, good or bad, require DRM in order to do this and users agree because they want the content. Most aren’t content to go to the Internet Archive to watch free content instead of current media…
So, apples and oranges. If you can convince users that standing on principles for being DRM-free is more important to them than watching House of Cards, you can win this fight. Good luck!
Can’t speak for heeveel, but in my case yes. No smartphone either. And keep in mind I have absolutely no objection to you - or anyone else - having any of those things and I don’t think less of you for it. Follow your bliss, I say.
I simply have no need of or desire for those things.
General purpose computing and communication devices, I need those, yes indeedy. But I don’t need hollywood, popular television, or a phone in my pocket. Don’t want it, don’t need it.
Edit: I see @heeveel already gave a better answer than me, that’ll teach me to finish the thread before posting.
1 Like
This is where I point out that neither you nor @heeveel are typical Firefox users. Firefox can’t be all things to all people but it does have to be relevant to a large number of people to have the leverage to work towards the manifesto and an open web. I know people will say any move in the direction of DRM is against that but we already had that in the big, hurkin’, unsafe plugins of silverlight and flash. The new system is actually much safer for everyone, from a practical security point of view, and much more limiting of third parties than the current system. The fact that refusing to do so also loses Mozilla any leverage in this space is also a factor.
I think you meant to respond to @albill, not me.
Hah. And just a few weeks ago, you suckers were all so delighted about how you got Mozilla to fire somebody for holding an unpopular political opinion. Maybe you’ll learn from this that a company that instantly caves to the whims of a Twitter mob is not the sort of company that’s going to stand fast for principle when something much more powerful shows up and starts making demands.
1 Like
No. My initial discussions with Moz about this, some months ago, included Brendan explaining why he supported this.
Uh, who the hell uses Firefox anymore, anyway?
Nope. He was just curious. But it seems there are a few special snowflakes here that are a bit hypersensitive.
1 Like
Mozilla could, if it wanted to bow to the use of DRM (which I think it shouldn’t) also still demand that the plugin is free software. I know that this runs counter to the spirit of DRM, but it’s still a requirement for me to want to ever use it.
How about full source code with the four freedoms?
If Mozilla got behind the effort and refused to endorse a DRM-enabling plugin, it would be very helpful! Alas …
I agree.
But look at it as I see it in the code now vs code later:
Now, under the definition used in this article, RIGHT NOW, Firefox has DRM. It has a plugin architecture that is widely derided, tightly coupled to the code, which allows plugin modules that use DRM to control what you can and cannot see. Because of the wide open nature of this DRM and plugin environment, content providers can gain sweeping access to your browser process as well as multiple layers of data contained in your system. While the plugin architecture is open source, much of what goes on behind the scenes in these DRM plugins that power Netflix, HBO Go, Google Play, and others are unseen to the customer / consumer in the current architecture. There is no auditing their system calls or controls on what they do or do not have access to. Because of this, Firefox has been viciously derided. Chrome/Google have actually removed this plugin architecture from their browsers because of repeated security assessments suggesting it’s horrible.
That’s right now. That’s what Firefox has had for years. That’s the system people who are lamenting this decision want to KEEP.
In the future, Firefox proposed a temporary locked down sandbox. In this sandbox, the plugin supplied by adobe and others will be able to run, but will NOT have access to the remainder of the browser. There will be very minimal contact points between the underlying computer and the browser. When you go to a site like Netflix, you will opt in to the DRM , and the DRM provider will be listed. Because the interaction of the plugin with the browser has been moved FROM the plugin to the Sandbox’s API, you will be able to audit what the the plugin does with the browser. Because the api will be highly limited and the sandbox will be highly secure, the plugin will not be able to interact with your underlying system (as it can RIGHT NOW, slurping information from where ever it wants to because it currently runs as a first class program on your system, not within any contained spaces.) Because the sand box will be controlled by the browser, and NOT the plugin, you will be able to completely sever it at will. Because Firefox / Mozilla wants to maintain legality and controls, they will heavily isolate this code from the remainder of the firefox codebase. It’ll be easy to excise, and control will be from the browser side, not the plugin side.
I can understand being upset if this whole thing was a dramatic change for the negative by mozilla. But with regards to DRM and its plugin architecture, Mozilla has already BEEN negative for a very long time. The world of extensions and plugins in Firefox has been the wild west. I encourage you to look at your current installed plugins in firefox and look for access controls. Can you tell a plugin or extension not to access your file system? Can you tell it not to access cookies, or to always run in PrivateBrowsing mode, or can you alter it’s security permissions? Do you see the permissions necessary pop up when you install an extension? Do you know what it is capable of doing?
The answer to all of this is a no. You can’t, not without diving deep into the code and stepping through individually, if you manage to have an addon that is written in html/javascript and not one that is native NPAPI.
So that’s what’s got me so upset at all these headlines about how Mozilla “capitulated/embraced/accepted/allowed/fell into/loves” DRM. IF this decision is a shitty one, Mozilla made it years ago when they wanted an API to display PDFs (that Adobe would not allow without this plugin architecture.) The decision to actually control, isolate, and allow the user to see what these plugins are doing to the browser and their computers is a step forward for us, not a step back.
3 Likes
actually thinks so.
for the government to say what you can and cannot say runs antithetical to the concept of freedom of speech. the first amendment exists for this EXACT reason. to protect people’s ability to share information, even information which the government doesn’t, or special interests don’t, want shared but which is ultimately beneficial to a healthy society. the same freedom that protects locksmithing books or classes should protect communication of ways to break DRM (i mention locksmithing because that was the source of similar hand wringing back when books on the subject first became widely available)
1 Like
Use your imagination. If you can write and use your own sandbox, then you can write sandboxes that have the sole purpose of instrumenting CDMs for the purposes of reverse engineering them. You wouldn’t even need a browser - the CDM is aware only of the sandbox environment it lives in, so the only thing that’s needed is the sandbox itself. I wouldn’t be surprised if projects like this are already ramping up.
This will lead to an arms race between proprietary CDM makers and hackers who continually reverse engineer and crack them (see also: iPhone jailbreaks). The end game will be rights holders giving up on this kind of DRM altogether and trying to shove something even more heinous down our throats.
1 Like
Ok, so instead of allowing proprietary closed source plugins like Flash that have complete control of your PC, they are allowing limited scope, sandboxed proprietary closed source DRM modules that have no other access.
I can’t think of any way that this isn’t a good thing, without it you would just have another plugin for video play back that has the potential to access everything on your PC, all they are doing is creating another type of plugin that has very limited scope and no external access to anything else on your computer.
1 Like
What’s the point? They already support binary plugins like Flash, without this DRM plugin sandbox anyone can make a regular plugin to handle DRM content that has complete access to everything on your PC anyway.
The only thing not supporting this limited DRM scheme is doing is denying everyone a more secure method of choosing to view protected video content and leaving us all with vulnerable plugins like Flash.
1 Like
[quote=“Spinkter, post:97, topic:31332, full:true”]
Use your imagination. If you can write and use your own sandbox, then you can write sandboxes that have the sole purpose of instrumenting CDMs for the purposes of reverse engineering them. You wouldn’t even need a browser - the CDM is aware only of the sandbox environment it lives in, so the only thing that’s needed is the sandbox itself. [/quote]
Yes, but I can write my own sandbox already, if I want to. I don’t need Mozilla’s DRM plugin to be free software to do that. I need Mozilla’s DRM plugin to be free software in order not to be screwed by Mozilla and DRM, which was always the point of insisting on software being free.
Well then, I have to ask: Why don’t you simply stop using Mozilla, and switch to another browser?
2 Likes
Mozilla does not have a DRM plugin.
It has a sandbox environment that is much tighter and much more security conscious than their previous NPAPI environment where DRM plugins run now.
If you are calling a new and more auditable plugin architecture “DRM” , then by rule, Firefox has not changed at all with this announcement.
2 Likes
