I'd say that's off by at least 5 years and it didn't take the ubiquity of home broadband to bring it about (although it certainly helped)
Yeah, there wasn't some magic point where it started. It was probably the first big worms when the mass audience became aware of the threat.
I was a callow MacOS 9 hipster video nerd back then, so it wasn't something I was that focused on myself.
But that doesn't leave Microsoft with a spotless record. Most of the products you've listed have had (or in some cases continue to have) issues. That isn't necessarily a criticism in itself; it depends on context.
Yep, pretty much any OS is going to get at least one security patch a month, it seems. And it's a lot harder to harden after the fact than it is to have security a clear focus and mandate before the first dry-erase marker hits whiteboard. Plus we have the benefit of the scarred veterans of many exploits to help us avoid making old mistakes with new products.
That entire list of products were developed with the full knowledge of the hostile environments in which they'd operate. Yet vulnerabilities came to light in many cases. With that in mind, claiming that Silverlight is OK because it's new and developed for a hostile environment sounds a little too much like marketing - and a line that we've all heard before, at that.
Sure. Nothing is ever provably secure. But code heritage matters, and so does track record. It's no guarnatee of future security, but it's something.
It does not address the fact that Silverlight does present another potential attack vector.
Yep. It's always a matter of relative security versus importance of features. If users are going to be watching vidoe in browsers, the question is Silverlight's relative security compared to other plugins, players, and now browsers available. Comparing both architectural design and breech history between those is probably useful.
As he said, those features are all available on the video players already available. QuickTime and QuickTime Streaming Server (and it's Open Source version Darwin Streaming Server) already offer all those features
Er, no, they aren't.
QuickTime Media Layer back in the day did some of those, but tool development was abandoned after Jobs came back to Apple, and client-side support for interactive features have slowly been dropped for security reasons.
QTSS/DSS are actually pretty bad choices for long-form on-demand content delivery, due to the lack of bandwidth negotiation.
Right, but the Mono people cannot implement the DRM; only MSFT can, and until the MSFT-provided codecs can do DRM, Linux will remain a second-class client. Whether this is a problem for your bosses is another matter.
Well, first lets start with a feature request.
Do you think the Linux community would be okay with us integrating DRM support into the downloadable codec pack? It seems like the kind of thing we're going to get yelled at about one way or another:).
Depends entirely on the segement of the community to which you're referring, rather like the Windows community. Most would rather like to be able to get the full experience. Of course, in an ideal world, no DRM would be present at all. Sadly, the world isn't ideal.
Yep, when it comes to Hollywood content DRM is a contractual obligation.
The stuff that we publish in Smooth Streaming ourselves rarely uses DRM, but that's not an option for Netflix.
Internet video stutters for me, very annoying. (Yes, I installed silverlight because of this) Looking for torrent now... Wouldn't if they (Tuva) knew how to cache like Youtube, while in pause.
You're getting stuttering with this player? What's your connection speed and system specs? Where are you located?
These should be fine as long as you can sustain 300 Kbps or higher.
Or did you just mean that internet video stutters for you in general?
The site need Silverlight to view the lectures, so one has to wonder whether Microsoft was looking for a 'killer application' to make people want to install the plug-in.
It would be lovely to live in a world where historical physics lectures where the killer app to drive installs, but I doubt they'll make a material impact on installed base:).
Silverlight's already on more than a third of internet-connected devices, so it'd take tens of millions of ne installs for any single site to make a significant market share bump .
However, exactly when did the 'web shift to a "presumed hostile" state?
2000 or so? Probably when always-on broadband become common.
I ask because by my count, we've been in a hostile environment for years. And throughout those years, Microsoft has either introduced some very disturbing implementations or promised secure implementations that later fall short of these grand claims
Certainly XP as released was way too trusting. But I think Microsoft's track record has been quite positive since XPSP2. I wasn't around for that period, but it definitely got people VERY focused on security as something that has to be baked into product design from the inception of the product. Vista, IE 7/8, Silverlight, Office 2003/2007 all have had much better security records than their predecessors.
Lots of complaints about Microsoft products, most notably Vista, are on areas where Microsoft prioritized security over simplicity or backwards compatibility. And that's a problem for everybody, including Mac and Linux, with years of regular security updates ahead of us.
It's been easier in Silverlight since there wasn't anything to be backwards comaptible to. But there are defintley features that have been cut, delayed, or reduced in scope due to the test cost of verifying security. Every feature gets a threat model and security test plan before it gets approved.
We're really serious about it. On the media side, for example, there's a lot of fuzz testing of malformed bitstreams to make sure there's no way to cause a crash that could then lead to an exploit.
Very rarely. When I do, I use any one of a number of available tools that fetch the.flv and watch it with mplayer. A simple http:/// link to a video file is superior in every imaginable way to this embedded garbage.
Check out some links to the player in action. It does a whole lot of stuff that MPlayer can't.
It's really more like a Blu-ray or Director style media playback application. It's not just a rectangle with some codecs.
I already have a video player on my system, and Silverlight offers me nothing that I can't do without it.
Sure it can. Check out the player experience, and its navigation, commentary, captioning, etcetera. And it uses Smooth Streaming to provide proxy-cachable video at multiple bitrates.
It does however potentially contain vulnerabilities that could compromise my system
FWIW, Silverlight so far has had 0 exploits over three versions. It's done well compared to other media players in the same period. One advantage of a relatively recent technology is that it was designed for security from the get-go, after the web had shifted to its current "presumed hostile" state.
I don't care that it's MS Research. The irritating part is that my "browser is not compatible" because I don't use silverlight.
What browser do you use?
Also, if you look at the design of the video experience, it really couldn't be done without Silverlight. This isn't just a simple video player, but with integrated captions, commentary, graphical links, and delivered via Smooth Streaming.
It's really a media player app using Silverlight as the runtime; there's certainly many thousands lines of source for the managed code driving that experience.
Um, wait. Mono is said to be a free as in speech implementation of C#, but aren't the codecs, which are what really matters for watching video, still proprietary? (Not a rhetorical question; I'd really like to know.)
The video codces in Silverlight 3 are H.264 (ISO standard) and VC-1 (SMPTE standard). So, they're open specifications but the patents are licensed from MPEG-LA.
Moonlight offers to download fully licensed binary implementations of the Silverlight codecs from Microsoft.
Wrong. Pretty much all DVD players by LG, Samsung and Sony support DivX, not to mention every video-capable portable media player from the PSP to chinese-made "MP4 players", none of which support h.264.
But none of the cable/sat set top boxes do Part 2, and there are tons of those. And they account for many, many more eye-ball hours than Part 2 on DVD players; most users have probably never watched a "divx" file off disc.
Flash and Silverlight don't have Part 2 support. QuickTime does SP, but not ASP.
I'm confident the number of H.264 players in use today is substantailly bigger than for MPEG-4 part 2.
Actually, H.264 advantages are bigger the lower the bitrate. The combination of the in-loop deblocking filter and CABAC entropy coding make a huge difference at low bitrates.
XviD isn't even a candidate in this, even though it has far wider support in both hardware and software than h.264. Why? "ohh, h.264 is much better". What makes you think the same won't happen with h.264 itself?
No, I bet H.264 has more decoders out there than MPEG-4 ASP. There're certainly much more content, and more authoring tools.
ASP really only caught on in the piracy scene.
Plus MPEG-4 Part 2 is also licensed by MPEG-LA, so it doesn't address licensing issues, but it'd a lot weaker codec than H.264.
Microsoft hasn't commented, which isn't the same as supporting neither. However, considering that silverlight 3.0 is slated to support H.264, I suspect that says a lot by itself.
Silverlight 3's Raw AV pipeline should be able to support Ogg Theora/Vorbis:
It seems like Apple has something against implementing any Xiph codec... FLAC and Vorbis support in iTunes is nonexistent, and even with the QuickTime plugin, iTunes still doesn't have proper tagging support. And now refusing to add Theora support in Safari?
No need for conspiracy theories. Theora doesn't solve any problems for Apple.
Theora won't work in iPods, iPhones, or AppleTV.
And Theora is less efficient than even H.264 baseline, and so would raise their (presumably quite substantial) bandwidth costs for delivering video content.
I think Microsoft has lost the media wars, and they pretty well know it. (admittedly, just a guess) Expect their products to support H264 and AAC.
Microsoft products have supported H.264 and AAC for quite a while. They're in Zune, Xbox 360, MediaRoom (IPTV), and it's coming in Silverlight 3 and Windows 7.
by the time we could safely drop HTML5 support from our web browsers there'll be at least a dozen codecs that perform far, *far* better than H.264 does today
What codecs are you thinking of? None of the research codecs have come close to matching H.264 so far. The most promising efforts are those of MPEG, working on what's likely to become H.265.
I can't think of even a dozen new delivery codecs being worked on. Theora, Snow, Dirac... What else?
The plus of the ISO process is that everyone with a great codec idea they'd like to get paid for brings it to the table, so you get that alchemy of all the best current ideas being implemented together, with lots of tuning by relevant experts.
Coming up with a competitive codec bitstream requires a sustained multi-year effort by dozens of experts.
Slashdot Mirror
Are you running the current Moonlight Preview? That's required for managed code support, and hence Smooth Streaming.
This definitely works in Moonlight. If you can see it, you've got it installed correctly.
http://www.iis.net/media/experiencesmoothstreaming
I'd say that's off by at least 5 years and it didn't take the ubiquity of home broadband to bring it about (although it certainly helped)
Yeah, there wasn't some magic point where it started. It was probably the first big worms when the mass audience became aware of the threat.
I was a callow MacOS 9 hipster video nerd back then, so it wasn't something I was that focused on myself.
But that doesn't leave Microsoft with a spotless record. Most of the products you've listed have had (or in some cases continue to have) issues. That isn't necessarily a criticism in itself; it depends on context.
Yep, pretty much any OS is going to get at least one security patch a month, it seems. And it's a lot harder to harden after the fact than it is to have security a clear focus and mandate before the first dry-erase marker hits whiteboard. Plus we have the benefit of the scarred veterans of many exploits to help us avoid making old mistakes with new products.
That entire list of products were developed with the full knowledge of the hostile environments in which they'd operate. Yet vulnerabilities came to light in many cases. With that in mind, claiming that Silverlight is OK because it's new and developed for a hostile environment sounds a little too much like marketing - and a line that we've all heard before, at that.
Sure. Nothing is ever provably secure. But code heritage matters, and so does track record. It's no guarnatee of future security, but it's something.
It does not address the fact that Silverlight does present another potential attack vector.
Yep. It's always a matter of relative security versus importance of features. If users are going to be watching vidoe in browsers, the question is Silverlight's relative security compared to other plugins, players, and now browsers available. Comparing both architectural design and breech history between those is probably useful.
As he said, those features are all available on the video players already available. QuickTime and QuickTime Streaming Server (and it's Open Source version Darwin Streaming Server) already offer all those features
Er, no, they aren't.
QuickTime Media Layer back in the day did some of those, but tool development was abandoned after Jobs came back to Apple, and client-side support for interactive features have slowly been dropped for security reasons.
QTSS/DSS are actually pretty bad choices for long-form on-demand content delivery, due to the lack of bandwidth negotiation.
Right, but the Mono people cannot implement the DRM; only MSFT can, and until the MSFT-provided codecs can do DRM, Linux will remain a second-class client. Whether this is a problem for your bosses is another matter.
Well, first lets start with a feature request.
Do you think the Linux community would be okay with us integrating DRM support into the downloadable codec pack? It seems like the kind of thing we're going to get yelled at about one way or another :).
Yep, right there in my email address.
My blog: http://on10.net/blogs/benwagg
For about 3.5 years now, I'd hit the karma cap here will before then :).
Depends entirely on the segement of the community to which you're referring, rather like the Windows community. Most would rather like to be able to get the full experience. Of course, in an ideal world, no DRM would be present at all. Sadly, the world isn't ideal.
Yep, when it comes to Hollywood content DRM is a contractual obligation.
The stuff that we publish in Smooth Streaming ourselves rarely uses DRM, but that's not an option for Netflix.
Internet video stutters for me, very annoying. (Yes, I installed silverlight because of this) Looking for torrent now... Wouldn't if they (Tuva) knew how to cache like Youtube, while in pause.
You're getting stuttering with this player? What's your connection speed and system specs? Where are you located?
These should be fine as long as you can sustain 300 Kbps or higher.
Or did you just mean that internet video stutters for you in general?
The site need Silverlight to view the lectures, so one has to wonder whether Microsoft was looking for a 'killer application' to make people want to install the plug-in.
It would be lovely to live in a world where historical physics lectures where the killer app to drive installs, but I doubt they'll make a material impact on installed base :).
Silverlight's already on more than a third of internet-connected devices, so it'd take tens of millions of ne installs for any single site to make a significant market share bump .
Silverlight (WMV) is in a standards based format, you can check it out in Mono.
These are actually Smooth Streaming files.
http://www.iis.net/extensions/SmoothStreaming
FWIW, Silverlight 3 supports WMV, MPEG-4 (with H.264), Smooth Streaming, and supports managed code decoders and parsers to add additional formats.
Same goes for anyone "subscribing" to media outlets for a long time which requires Silverlight . It probably means they are easily bought out.
What else would you use if you wanted to do cost-effective live HD streaming?
Media companies who use Silverlight are mainly using it to do stuff there aren't any other ways to do.
We're seeing a huge amount of live sports projects using Silverlight, because nothing else can deliver the same experience economically.
Her's a bunch of high-profile projects: http://team.silverlight.net/
Why do I want all that?
Becase more context makes it easier to learn and retain the information, and to explore further in topics of interest?
This is web video; we should offer more than VHS interactivity and richness.
Without DRM. Big, important exception, as this means e.g. no Netflix streaming.
Well, here's an actually serious question.
What kind of DRM implementation would the Linux community accept in Moonlight?
However, exactly when did the 'web shift to a "presumed hostile" state?
2000 or so? Probably when always-on broadband become common.
I ask because by my count, we've been in a hostile environment for years. And throughout those years, Microsoft has either introduced some very disturbing implementations or promised secure implementations that later fall short of these grand claims
Certainly XP as released was way too trusting. But I think Microsoft's track record has been quite positive since XPSP2. I wasn't around for that period, but it definitely got people VERY focused on security as something that has to be baked into product design from the inception of the product. Vista, IE 7/8, Silverlight, Office 2003/2007 all have had much better security records than their predecessors.
Lots of complaints about Microsoft products, most notably Vista, are on areas where Microsoft prioritized security over simplicity or backwards compatibility. And that's a problem for everybody, including Mac and Linux, with years of regular security updates ahead of us.
It's been easier in Silverlight since there wasn't anything to be backwards comaptible to. But there are defintley features that have been cut, delayed, or reduced in scope due to the test cost of verifying security. Every feature gets a threat model and security test plan before it gets approved.
We're really serious about it. On the media side, for example, there's a lot of fuzz testing of malformed bitstreams to make sure there's no way to cause a crash that could then lead to an exploit.
Very rarely. When I do, I use any one of a number of available tools that fetch the .flv and watch it with mplayer. A simple http:/// link to a video file is superior in every imaginable way to this embedded garbage.
Check out some links to the player in action. It does a whole lot of stuff that MPlayer can't.
It's really more like a Blu-ray or Director style media playback application. It's not just a rectangle with some codecs.
I already have a video player on my system, and Silverlight offers me nothing that I can't do without it.
Sure it can. Check out the player experience, and its navigation, commentary, captioning, etcetera. And it uses Smooth Streaming to provide proxy-cachable video at multiple bitrates.
http://alexzambelli.com/blog/2009/03/27/smooth-streaming-white-paper/
It does however potentially contain vulnerabilities that could compromise my system
FWIW, Silverlight so far has had 0 exploits over three versions. It's done well compared to other media players in the same period. One advantage of a relatively recent technology is that it was designed for security from the get-go, after the web had shifted to its current "presumed hostile" state.
I don't care that it's MS Research. The irritating part is that my "browser is not compatible" because I don't use silverlight.
What browser do you use?
Also, if you look at the design of the video experience, it really couldn't be done without Silverlight. This isn't just a simple video player, but with integrated captions, commentary, graphical links, and delivered via Smooth Streaming.
It's really a media player app using Silverlight as the runtime; there's certainly many thousands lines of source for the managed code driving that experience.
Um, wait. Mono is said to be a free as in speech implementation of C#, but aren't the codecs, which are what really matters for watching video, still proprietary? (Not a rhetorical question; I'd really like to know.)
The video codces in Silverlight 3 are H.264 (ISO standard) and VC-1 (SMPTE standard). So, they're open specifications but the patents are licensed from MPEG-LA.
Moonlight offers to download fully licensed binary implementations of the Silverlight codecs from Microsoft.
200+ is for all the developer goo.
The Client Profile for .NET 3.5 SP1, which is all that's needed to install a .NET app on a machine that doesn't have .NET 3, is 28 MiB.
http://msdn.microsoft.com/en-us/library/cc656912.aspx
And Silverlight is less than 5 MiB if the app can run entirely in the Silverlight sandbox.
Mono is 75 MiB on Windows, 56 MiB on Mac, . Moonlight is (really?) 941 KiB.
Wrong. Pretty much all DVD players by LG, Samsung and Sony support DivX, not to mention every video-capable portable media player from the PSP to chinese-made "MP4 players", none of which support h.264.
But none of the cable/sat set top boxes do Part 2, and there are tons of those. And they account for many, many more eye-ball hours than Part 2 on DVD players; most users have probably never watched a "divx" file off disc.
Flash and Silverlight don't have Part 2 support. QuickTime does SP, but not ASP.
I'm confident the number of H.264 players in use today is substantailly bigger than for MPEG-4 part 2.
...for high bitrates
Actually, H.264 advantages are bigger the lower the bitrate. The combination of the in-loop deblocking filter and CABAC entropy coding make a huge difference at low bitrates.
XviD isn't even a candidate in this, even though it has far wider support in both hardware and software than h.264. Why? "ohh, h.264 is much better". What makes you think the same won't happen with h.264 itself?
No, I bet H.264 has more decoders out there than MPEG-4 ASP. There're certainly much more content, and more authoring tools.
ASP really only caught on in the piracy scene.
Plus MPEG-4 Part 2 is also licensed by MPEG-LA, so it doesn't address licensing issues, but it'd a lot weaker codec than H.264.
Microsoft hasn't commented, which isn't the same as supporting neither. However, considering that silverlight 3.0 is slated to support H.264, I suspect that says a lot by itself.
Silverlight 3's Raw AV pipeline should be able to support Ogg Theora/Vorbis:
http://on10.net/blogs/benwagg/Silverlight-3-Beta-Whatrsquos-New-for-Media/
Someone's already working on a port of the Ogg wrapper and Vorbis for Silverlight and Moonlight:
http://veritas-vos-liberabit.com/monogatari/2009/03/moonvorbis.html
It seems like Apple has something against implementing any Xiph codec... FLAC and Vorbis support in iTunes is nonexistent, and even with the QuickTime plugin, iTunes still doesn't have proper tagging support. And now refusing to add Theora support in Safari?
No need for conspiracy theories. Theora doesn't solve any problems for Apple.
Theora won't work in iPods, iPhones, or AppleTV.
And Theora is less efficient than even H.264 baseline, and so would raise their (presumably quite substantial) bandwidth costs for delivering video content.
I think Microsoft has lost the media wars, and they pretty well know it. (admittedly, just a guess) Expect their products to support H264 and AAC.
Microsoft products have supported H.264 and AAC for quite a while. They're in Zune, Xbox 360, MediaRoom (IPTV), and it's coming in Silverlight 3 and Windows 7.
by the time we could safely drop HTML5 support from our web browsers there'll be at least a dozen codecs that perform far, *far* better than H.264 does today
What codecs are you thinking of? None of the research codecs have come close to matching H.264 so far. The most promising efforts are those of MPEG, working on what's likely to become H.265.
I can't think of even a dozen new delivery codecs being worked on. Theora, Snow, Dirac... What else?
The plus of the ISO process is that everyone with a great codec idea they'd like to get paid for brings it to the table, so you get that alchemy of all the best current ideas being implemented together, with lots of tuning by relevant experts.
Coming up with a competitive codec bitstream requires a sustained multi-year effort by dozens of experts.