Firefox 38 Arrives With DRM Required To Watch Netflix
An anonymous reader writes with this excerpt from VentureBeat: Mozilla today launched Firefox 38 for Windows, Mac, Linux, and Android. Notable additions to the browser include Digital Rights Management (DRM) tech for playing protected content in the HTML5 video tag on Windows, Ruby annotation support, and improved user interfaces on Android. Firefox 38 for the desktop is available for download now on Firefox.com, and all existing users should be able to upgrade to it automatically. As always, the Android version is trickling out slowly on Google Play.
Note that there is a separate download for Firefox 38 without the DRM support. Our anonymous reader adds links to the release notes for desktop and Android.
I think you meant Digital Restrictions Management. It's a sad day for Mozilla, the w3c, the web as a whole, and open culture. At least there's still the iceweasel fork that doesn't come with this shit.
HAL 7000, fewer features than the HAL 9000, but just as homicidal!
If you read the article they are already providing that option.
https://blog.mozilla.org/blog/2015/05/12/update-on-digital-rights-management-and-firefox/
We're talking about Firefox and not Chrome.
At least there's still the iceweasel fork that doesn't come with this shit.
The DRM isn't a closed source part of *firefox*. It's a separate external plugin (like flash, etc.) that runs sandboxed (like chrome) and that can be
disabled and/or removed like any other plugins (or you can download a version of the installer that doesn't even pack the DRM module).
You don't need to go as far as Iceweasel.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Is there an explanation of how this works ? At the end of the rendering pipeline shouldn't there be an unencrypted frame for display, and couldn't somebody it just grab it from there ?
so, do we now have open source firefox and non open source firefox
The DRM isn't a closed source part of *firefox*. It's a separate external plugin (like flash, etc.) that runs sandboxed (like chrome) and that can be
disabled and/or removed like any other plugins (or you can download a version of the installer that doesn't even pack the DRM module).
You won't have a separate opensource and closed source firefox.
The choice is whether to use or not the external 3rd party binary plugin (juste like flash, again).
It's just that the default installer of Firefox for Windows does pack the .DLL together with Firefox for end-user's convenience. But as mentionned, you can download an installer without it.
And even if you install it, it's up to you to use or not this piece of closed source software.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
according to all what I've read:
Yup, they have indeed implemented it this way (DRM is mainly a small external plugins. Firefox feeds encrypted stream into it, and get decrypted stream out. Plugin runs in a sand box and isn't allowed to do anything else)
But if you read the original EME specification, there's another possible implementation:
- it's also possible to write an EME plugin that is entirely in charge of presenting the decrpyted video on screen. Firefox feeds encrypted data into 3rd party plugin, plugin it self access screen and displays video on it.
That would be a clear violation of the sandbox that 3rd party EME plugins are currently run in, but in theory the specifications offer such alternative.
Still, even such an approach is open to screen-grabbing so it's just as useless as the current implementation and only opens security risks (as the 3rd party EME plugin won't be inside a sandbox restricting to only stream IO and decryption).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I think what we have is clear examples of people who read the article and those who did not.
02 The Internet is a global public resource that must remain open and accessible.
not when you bundle digital restrictions management with your browser and only offer the truly open one as an 'option'
04 Individuals security and privacy on the Internet are fundamental and must not be treated as optional.
quit enabling googles malware system, and stop enabling targeted ads by default.
05 Individuals must have the ability to shape the Internet and their own experiences on it.
thats the direct antithesis of DRM. same goes for point 06 on interoperability.
07 Free and open source software promotes the development of the Internet as a public resource.
but DRM does not.
08 Transparent community-based processes promote participation, accountability and trust.
I dont remember hearing a goddamn thing about you adding DRM or targeted ads before you just decided to do it.
Good people go to bed earlier.
rather than fixing bugs
For some users, "I can't watch Netflix, your browser is broken !" is an important bug enough.
At least providing a way to install an optional 3rd party plugin to handle DRM, *and* provide a sandbox that restricts the plugin to only decrypt the encrypted data stream it receives (no file-system access. no network access) isn't such a bad idea given the insistance of end user to access restricted content.
It's not as if Firefox itself has become closed source.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
No, no, you're missing some steps:
1) The studios (Fox, Paramount, Sony, etc.) tell Netflix that without DRM, Netflix is going to have its own original series to stream AND THAT'S ALL.
2) Netflix decides it might be wise to include D-R-M unless they want to go B-A-N-K-R-U-P-T.
3) The major browser companies all adopt DRM too, since no one wants to be the one browser that doesn't work with Netflix
4) You, the user, streams movies from your browser.
SJW's don't eliminate discrimination. They just expropriate it for themselves.
Still, it would've been better to leave the DRM where it belongs, in plugins to be installed by each user who wants to have their rights managed.
Which is exactly how the standard works - except now the plug-in interface is standardized. So much nerdwhine over nothing with the HTML5 DRM stuff. Feel free to grab the "can't watch Netflix" version if it makes you happy. Not needing Silverlight (or Flash, or some other exploit delivery engine) makes me happy.
Socialism: a lie told by totalitarians and believed by fools.
Still, it would've been better to leave the DRM where it belongs, in plugins to be installed by each user who wants to have their rights managed.
That's exactly the case right now.
Firefox only provides a sandbox into which the 3rd party CDM plugin will be run.
Encrypted stream goes in.
Decrypted stream goes out.
Nothing else is authorised for this plugin.
It's more or less the same situation as Flash (it's not firefox itself that is playing the flash content), except with a much better and way much more restrictive sandbox.
They are merely providing 1 installer packing 1 CDM by adobe inside for end user convenience.
But there's even an installer with only the mozilla code, without 3rd party pluging if you want.
Yep this should be an easy crack, with most of the source code being available. Firefox 38 will also be known as Netflix Video Ripper 1.0!
Actually not. Firefox doesn't handle decryption it self. Only provides the sandbox into which to run it.
To rip Netflix, you'll need to go the other way around:
- creat your own video downloader, that simply harness any of the 3rd party CDM plugins compatible with Netflix (Firefox use a CDM by adobe, Google Chrome uses another by Widevine).
- as Firefox basically restricts their to only function as a decryption filter, you need to provide code that feeds the data into the plugin, and code that package the decrypted stream into a MKV.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Which is exactly how the standard works - except now the plug-in interface is standardized. So much nerdwhine over nothing with the HTML5 DRM stuff. Feel free to grab the "can't watch Netflix" version if it makes you happy. Not needing Silverlight (or Flash, or some other exploit delivery engine) makes me happy.
That's how I see it. I'll be happy to be able to watch Netflix on my HTPC in the same quality as a streaming device. It seems like we may have more flexibility in how we can get our Netflix. As far as I can tell, and I certainly am no expert, no existing feature or function of Firefox is lost.
Actually, support for EME *is* implemented as a sandbox, into which the 3rd party CDM plugin runs.
sandbox block access to filesystem and network.
only encrypted stream goes in. only decrypted stream goes out.
Okay, it's not as pervasive as Google Chrome's sandbox (they tend to sandbox as many other plugins as possible), but it makes the situation much better than what was before with Flash.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
because the API between firefox and the CDM are completely different.
usual plugins use NPAPI
CDM for EME-support runs inside a special sandbox that restricts it. CDM plugins are prevented from filesystem and network accesses (unlike Flash, for example)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Yes, that is covered in the 4th sentence of the summary.
Because of the limited scope (doesn't need to be able to open network sockets, access files etc.) the browser can sandbox it more effectively.
Before this new version of Firefox, the DRM was delivered via Silverlight. Either way, you are running a closed-source binary blob that handles DRM.
Previously, there was some hesitation to use this crap thanks to this lack of standardization. Now, thanks to this idiotic move by Mozilla this type of DRM will be used, and if you think it only apply to Netflix - or only apply to video - you haven't been paying attention.
Now that it is possible to for businesses to claim that "almost all of our potential customers support DRM", it will be used in many places. Remember the pages that show an image of text instead of just putting the text in the page? Well, get ready for the video equivalent the first time someone gets paranoid because browsers have a save-as feature. Besides, once DRM for one type of content is in place, the other industries will cry "equal access".
All of you who are "ok" with this, or are thinking only of convenience - your selfish view of the world is a big part of why this is happening. You should be fighting this, if you give a damn about having an free an open internet in the future. Unfortunately, you're probably going to mod me down and go back to cheering about how you get to watch movies in your browser, and I hope you enjoy fighting the far more difficult battles in the future, because you didn't stop this crap when it was still small.
Ce n'est pas une signature automatique.
You should have tho grab the "restricts my rights" version if that makes you happy while everyone else gets DRM-free Firefox by default. Mozilla shouldn't be helping to spread DRM by default-installing it for everyone. Not having a DRM plugin installed makes me happy (especially since it could still turn out to be an exploit delivery engine).
"When information is power, privacy is freedom" - Jah-Wren Ryel
So where are you doing your decryption ?
Because mozilla decided to promote DRM instead of a free web, we can look forwards to lots of sites (which used to work) displaying a nag screen with a link to download the "proper" version of firefox, specifically because the DRM version is a free download. They will assume everybody has support available, so there is no penalty to using this crap everywhere.
Or have you not been paying attention to how businesses work these days?
When the fight for freedom is hard, there are many potentially useful strategies. Giving up without a fight and simply handing victory to the enemy is not one of them.
Ce n'est pas une signature automatique.
I hope you enjoy fighting the far more difficult battles in the future, because you didn't stop this crap when it was still small.
The majority of internet traffic is DRMd video streams - has been for years. A standards committee has no power to tell the vendors what to do; instead their job is to write down what the big vendors are already doing, so that everyone else can interoperate.
Use the right tool for the job, man. If you want non-DRMd video, you're supposed to use a torrent client, not a web browser. Not every tool has to solve every problem, you know - let each be good for its purpose instead.
Socialism: a lie told by totalitarians and believed by fools.
...I'm going to come at this from another angle:
Instead of focusing on Firefox, let's focus on Netflix for a moment. Who the hell needs Netflix to pirate? 99% of things on Netflix are published elsewhere first. Netflix is equivalent to syndication--the guys that play stuff after it's already been premiered.
People target the services that premier shows for privacy. They don't wait 2 years for it to show up on Netflix to THEN pirate it. They go to the source.
Lastly, Netflix already rents out DVDs--which can be easily pirated and show up long before they hit online Netflix!
The only thing this could protect would be Netflix originals. So my point is this: It's either to fulfill contractual B.S. with their media providers, or, it's a complete waste of money that accomplishes nothing. My money would be on the former, though, because lots of stupid things like this are the result of "pleasing the customer."
Flash at least crashes
Fixed that for you.
Is there anything that stops someone getting the source and writing a function to simply dump out the decrypted stream? If so, then this is surely completely useless.
If not, how so?
SJW n. One who posts facts.
There are some positive aspects to the Encrypted Media Extensions API. It does provide some DRM options for companies like Netflix, which isn't great, but it can also enhance the security of personal media files. It will enable a web app to let you upload an encrypted video, then stream it from their server to your computer without having to download the entire thing and decrypt it -- without any browser plugin.
So if you really don't want anyone being able to see your personal videos (not just Netflix's videos), this thing isn't all bad.
Why is their not room for both the open and closed cultures?
Assuming s/their/there/:
Because the concentrated non-free media use their vast financial resources to lobby governments to make existence harder for free culture.
Big media uses copyright to squelch competition. It has successfully lobbied for successive extensions of the term of copyright, which reduces the chance that a work will enter the public domain while it remains culturally significant. It uses copyright claims to squelch comment on its works and "similarity" claims under copyright to interfere even with creation of original works, as you have no way of telling whether the song you wrote infringes the copyright of some other existing song out there.
Big media uses its massive selling power to convince viewers to purchase player devices designed to play only works created by sufficiently large commercial enterprises, giving it a captive audience. These include such as video game consoles (with their code signing), Blu-ray Disc players (with the requirement of an AACS license for BDMV), home Internet service plans (with their bans on running a home server, enforced through carrier-grade NAT or TOS disconnection), and AM and FM radio receivers (governed by scarce exclusive licenses to transmit). Furthermore, there exists only a finite amount of electromagnetic spectrum. Case in point: People commuting to and from work who are unwilling to pay for expensive cellular data plan have only AM and FM radio as means of discovering new music. When was the last time, for example, that you heard free recordings of free music on radio? (Here, by "free" I mean distributed under a license conforming to the Definition of Free Cultural Works.)
Big media even controls elections. All major U.S. television news outlets share a corporate parent with a major movie studio: CBS is Paramount, ABC is Disney, NBC is Universal, CNN is Warner Bros., and Fox is (duh) Last Century Fox. This gives them enormous power over name recognition, both in campaign contributions and in "in-kind" donations of name recognition through news coverage. It also helps them control what issues voters feel are important to them, as they tend not to report on threats to the existence of free culture unless it's something extraordinarily high-profile like Wikipedia's PROTECTIP protest blackout of 2012.
Sorry but Mozilla killed Firefox a long time go on their own and needed no input from anyone to do it.
Because I'd rather pay $8 for an honest license than pirate for the rest of my life.
You appear to think there are two options: use DRM or infringe copyright. There are actually three options: use DRM, infringe copyright, or voluntarily do without.
The scenario you describe is pretty much how it worked, with Google and Netflix doing most of the forcing, and Microsoft only helping out a little bit.
So, my Firefox did the whole pop-up thing with a message saying that it was urgent that I upgraded my browser for security reasons.
Did they offer me the DRM free version? NO.
Did they tell me that this next version would be infested with DRM? NO.
If the update was so urgent, why is the DRM free version dated 8th of may and it is now 13th May, it can't have been very urgent can it.
And why is it that when I went to about Firefox on the help menu it checked again for an update and said that none was available when Firefox had already told me that an update was available? FFS.
Waterfox - a Firefox fork with legacy extension support, security updates and better privacy by default.
Firefox tried to push open video formats, like webm, and refused to support H264... yet, after years of fighting they gave up, mostly because MS and Apple refused to support it to push their (patented group) H264 format. Only if google switched youtube to webm and stopped supporting H264 it would be possible to do something like that, but even if the webm was a google format, they never really pushed that change and H264 won this round.
Future video support is the new battleground. Yet W3C is set to accept DRM and firefox not supporting it would mean that important sites would either push the usage of other browsers (like netflix) or push the installation of broken plugins (like all the silverlght sites we have today) that may just exist in windows. Either way firefox would be lonely on this battle, as MS, Apple and Google all have interest in DRM video, so it would be a lost battle from the start. It is sad, but delivering video is only set to increase and big companies want to make money from it... even if the browser would not have any DRM, they would create "apps" to support it so that movie industry would allow online video streaming. It is a lost battle, since there is demand for it, not from the users, but from the content makers... and we all know they are stupid, they prefer having no market (and so piracy) than provide open access to their content, just look how music industry works with the internet and how long that battle is taking place
Firefox solution is to use a Adobe "plugin" that is very restricted on what it can do (read a stream, reply a stream), just to decode the DRM. This would allow the DRM validation that some companies require, allow one to disable this very easily and allow for future replacement of that closed "plugin" with any other open implementation (trying to push directly a open DRM "plugin" now could blacklist firefox if someone tried to remove the protection... later, with existent market share it would be harder to blacklist firefox)
So yes, no one wants DRM, not even Mozilla, but looking at the alternative (some other DRM support or protocol you can't control), at least Mozilla can have some control and impose limits by doing this and not sacrifice market share on a battle that would be lost anyway. Don't blame Mozilla on this one, blame MS, Apple and Google for teaming up pushing DRM, so much that W3C have also agreed to add a DRM standard.
Higuita
Maybe you should start paying attention to what's going on in the world. Major power-grabs are happening and you think it's about movies, simply because the people trying to grab power said so. I don't give a damn about movies or Netflix. What I do care about is legal precedent, the establishing of standards that will be used in other areas, the erosion of rights like the 1st-sale doctrine, and businesses that demand you weaken your computer security.
If this looks like a dystopian SF novel to you , maybe you should start doing something about it instead of accepting whatever price the publishing industry (not netflix) asks for just so you can see the latest movies. Welcome to the War On General Purpose Computing. Some of us have been fighting that war for over 20 years now, trying to prevent the "dystopian SF future". It would be nice if other people joined the fight once and a while, because we're losing the war; a decade ago Mozilla would have never caved, but the pressure has gotten a lot worse.
Anybody discussing movies isn't looking at the larger situation, where some people are asking you to hand your computer's root access over to them, and you do it because thy promise not to abuse that power while threatening to take your toys away.
Ce n'est pas une signature automatique.