Hacker News new | past | comments | ask | show | jobs | submit login
Chrome 57 Will Permanently Enable DRM (tomshardware.com)
216 points by fagnerbrack on Feb 20, 2017 | hide | past | favorite | 153 comments



This article is out of date.

If you look at the actual bug report [1], a replacement option to disable Widevine has already been implemented.

This isn't some evil plot, it's just fallout from Chrome removing support for third-party plugins and thus the plugin management UI (chrome://plugins).

[1] https://bugs.chromium.org/p/chromium/issues/detail?id=686430


> This isn't some evil plot, it's just fallout from Chrome removing support for third-party plugins and thus the plugin management UI

So instead it's just a fallout from an earlier plot that is no less evil than this one appears to be.


Removing binary plugin support is not evil at all.


but attempting to add DRM to an open standard is!


"Lesser of two evils". I prefer a nicely sandboxed and secured EME plugin over the insecure and clunkly silverlight pipelight trickery that was necessary before.

Blame the media industry for forcing it.


I don't think so.

If Google was only implementing DRM to tick boxes, they wouldn't be implementing "extracurriculars" like hardware-based DRM on ChromeOS devices.

They wouldn't own the very DRM company whose product they're peddling, a company which advertises to the very industry which is supposedly forcing Google's hand. http://www.widevine.com/

Take a look at this page and search for 'HW_SECURE_ALL': http://www.widevine.com/product_news.html

Now, what exactly is the point in implementing a more secure DRM variant (which as far as I can tell uses remote attestation) if content remains available to more 'vulnerable' platforms? We even have a potential lockin motive by Google here, too. I can see it now: "Only available on ChromeOS."


Did you know that Netflix only supports up to 720p on Chrome and Firefox? Because the DRM in those is easy to circumvent. People want higher than 720p, so browsers implement better DRM.


Google _is_ part of the media industry.


It's part of the advertising industry who's clients include the media industry.


True, but I was thinking more about the part where they sell music streaming services (Google Play Music, YouTube Red). Maybe I am wrong since they are not producers, but I considered this as being part of the media industry.


In order to confirm the plugin is in control of your computer, enough to prevent you from copying the precious bits, how sandboxed do you really think the DRM is? It has to have its claws like a rootkit into your machine in order to be "secure". How sandboxed can it be then?


> Blame the media industry for forcing it.

No, I'll blame the ad company pushing it into the browser.


Or we can blame google for gleefully going along too.


"Lesser of two evils" is piracy.


Blame the content producers who insist that distributors 'protect' their content with DRM. Distributors aren't going to leave that money on the floor.


Why not blame both, as both are to blame.

W3C is more to blame that all of them, as they have violated their mission statement with EME and DRM


I guess I just don't see the harm. If EME standardization did not take place at W3C, I think it would take place at another standards organization, or privately between content distributors and browser developers. Either way, it still happens and nothing is materially different.


If I go to a site that is "HTML5 Compatible" I should not have to worry if my "HTML5 Browser" has all the proper binary blobs and approvals to support the content.

If something is standard complaint it should work for all platforms that support the standard not just the Billion dollar corporations that paid to get their technology included into the standard


Come on we can't have it both way : promote the standard based Web and complain about the death of 3rd party plugin !


Why can't we? Do I really need that popup saying that 'developer mode' plugins are ZOMG HARMING ME? Because I installed ad nauseam that they removed because of the political BS?

Don't get me wrong, my beloved firefox is not better. It wants me to install dev edition to be able to install anything.

We made a mistake somewhere along the way.


Both of those things (unsigned plugins causing permanent warnings and/or only being enabled for a developer edition) happen because not doing them means leaking open the one last (huge) hole malware can infect computers through

The modern browser 1. is its own OS, but 2. doesn't have any concept of a privilege-level separation. That means any random program running as user X is free to install an extension into user X's Chrome or Firefox profile without needing to ask permission. And then said extension can harvest your social-network profiles, replace ads with their own, etc.


> Both of those things (unsigned plugins causing permanent warnings and/or only being enabled for a developer edition) happen because not doing them means leaking open the one last (huge) hole malware can infect computers through

Modern operating systems have a concept of users, groups of users and dedicating one of these to the role of administrator. I see no problem in not enforcing signing rule for the extensions installed by administrator (at system-wide locations, not user profile) - they are read only for the rest of the users anyway, so they couldn't be installed by drive-by malware. Power users are happy, naive users are protected.

If there is a malware that looks like installed by administrator, you have much bigger problems anyway. That malware could patch the firefox binary in the same way as it could deploy the extension, so you gained exactly nothing.

But the current situation just makes power users unhappy. This policy killed some extensions that were shipped by Linux distributions.


> But the current situation just makes power users unhappy. This policy killed some extensions that were shipped by Linux distributions.

I though this change was only about Windows? Chrome on Linux lets me load unsigned extensions just fine.


Sorry, I don't know about Chrome, I was talking about Firefox. AFAIK only Firefox extensions were shipped by distributions.


Fedora uses a patch to allow system installed addons.


Any random program running as user X, if malicious, can do far worse things to the user than install plugins into the browser.

Apparently the major browser vendors' solution to the problem of things running as users breaking the browser is to remove the ability for users to do things. This is a bogus solution.

See: Firefox's chrome-ification of the plugin system.


The mistake was made by companies abusing external plugin support to install plugins that make the browser vulnerable, slow or unstable.

The browser vendors then get to take all the "credit" for that. Their decision to remove support for external plugins is absolutely reasonable.


> Do I really need that popup saying that 'developer mode' plugins are ZOMG HARMING ME?

The feature was actively abused my malware so I guess this does makes sense.


I get why both browsers require signed plugins unless you are using the developer branch, on Windows 7 a huge vector of attack was malicious files loading unsigned plugins in Chrome in particular (also saw it in Firefox, but rarer) that would create popups, inject ads onto sites that didn't have ads, steal passwords, etc.

That being said, I wish there was a way I could use unsigned plugins easily, without reinstalling firefox.


Because flash, silverlight, java applets....


It's a debatable question what is evil. Governments were actively exploiting plugins, so removing them makes users more secure.


It seems they are moving the Flash and Widevine plugin enable options into the general settings, but they're not exposing any way to disable NaCl/NativeClient any more?


You can always delete the NaCL plugin, but I'd like to know this, too.


Force enabling all plugins and adding a disable button as an afterthought is a short-sighted evil plot.


But that's exactly how it was before.

Making it opt-in would be a terrible user experience.


As Google was one of the main enablers of DRM on the web[1], this is hardly surprising. Basically without Google colluding with NetFlix, we would still have a DRM-free web-standard.

Remember that next time you start up Chrome. You helped Google do this.

[1] https://en.wikipedia.org/wiki/HTML5#Digital_rights_managemen...


>Basically without Google colluding with NetFlix, we would still have a DRM-free web-standard.

>Remember that next time you start up Chrome. You helped Google do this.

For some reason you left out Microsoft who was also part of that gang who lobbied for EME... next time you boot windows and load up Edge, remember you helped Microsoft do this...

Of course the real demand for DRM comes from the content owners, aka Hollywood etc, who for some reason seem to think it has an effect on piracy, despite all the evidence to the contrary.

What does seem to have an effect on piracy is to give customers decent offers, like the netflix model, a fixed affordable fee that gives you access to a great library of content when you want it.


>>Remember that next time you start up Chrome. You helped Google do this. > ... next time you boot windows and load up Edge, remember you helped Microsoft do this...

Guys, let's keep in mind that the old days of the Google motto "don't be evil" are long gone. This isn't anymore a battle between good corporations and evil corporations. It's corporations on one side - all of them, including Google - wanting to maximize their profits (which is reasonable) at the cost of reducing people's freedoms (which is not), and common people here.


How are your freedoms being reduced by DRM?


Are you joking ?


No. DRM is just rights management. Content providers are free to provide content with whatever conditions they want and you're free to react in whatever way you want, including not viewing the content.

No freedoms have been harmed. Saying that they have doesn't make sense.


https://www.gnu.org/philosophy/right-to-read.en.html

Assuming DRM restrictions match, and always grant, actual legal rights, you'd be right. For instance, you should be able to break DRM to exercise your legal rights, such as education, quoting, ... In practice, you couldn't be more wrong.

For instance, please show me how DRM would allow me to quote a DRM protected video stream and replay it in court because, for instance, I was personally defamed in said video stream. Or I want to use a Disney movie scene in a video editor to include short quotes in an online course about storytelling. That won't work without the DRM being broken entirely off at my request, but it is my legal right.

What you're saying is a bit like pointing out that every homeless man has the right to do anything Donald Trump or Bill Gates are allowed to do. In theory, yes.


The damage of DRM is even more evident when the context is taken into account.

Excessive rights have been given to rights holders, such that the song "Happy Birthday to You", first published in print in 1912, entered the common domain in the EU this January 2017. 105 Years.

Patents last 20 years to ensure innovation continues. At some point creative works belong to the society that enabled them, not lucky rent seekers.

This makes it hard to keep an archive.

If DRM existed in a world where copyright rules were entirely sane, where would its disadvantages would outweigh its advantages?


> What you're saying is a bit like pointing out that every homeless man has the right to spend as much money as Donald Trump or Bill Gates do. In theory, yes.

I don't know what this means. Rights are not the same thing as opportunity.

Getting access to DRM content under legal rights is the same as getting access to any other protected content, through legal means. Licensing a copy, writing a subpoena, or numerous other options. While it may not be convenient, I still don't see where freedoms are being harmed.


> Licensing a copy, writing a subpoena, or numerous other options. While it may not be convenient, I still don't see where freedoms are being harmed.

Licensing is the name of the legal act where the rights holder confers additional rights to the user. There is no licensing involved for all the examples I gave, and no permission from the rights holder because I already have those rights. I don't need to license anything to exercise those rights.

DRM is taking away the means for me to exercise rights I already have.

It is like me placing a fence around your car, then claiming you need permission from me to open that fence, to which I can then attach conditions. For you to drive your car you need to go through me, even if it's not all that convenient. No, not even to "make sure it's legal".

This is not reasonable, and you expecting anyone to be happy about such a thing is insane.


No, it is not taking away any of your rights. You still have all the same rights.

The access to the content requires additional work, that is all. The fact that you still have your rights is what allows you to request that access for whatever situation you're in.


So if I lock you in a room, I am not taking away any of your right to go where you choose ? It's just your "means of getting there" that are somewhat limited and those aren't protected by law.

And yes, that's exactly how insane you sound. If you limit my "access to my rights" you have definitely taken away those rights. Stop spouting bullshit.


Bring a player to the court room, and advance the video position to where the defamation begins?

(Not defending DRM. DRM is garbage. If you have the ability and resources to break DRM, it is practically immoral of you not to do so.)


What DRM does is make sure that any player asks for permission from the rights holder every time anything gets played. Do you seriously think that when suing the rights holder for defamation. I would not suddenly find that permission revoked ?

(you sue the person who benefits from defaming you, not (necessarily) the one doing the actual act. For example, if CNN had paid some homeless man to say I beat him up, I would sue CNN, not the homeless man)


If it's evidence, then the court will force the rights holder to show the video.

How is this different than any other protected-access evidence material?


You have a strange idea of how law works. In sufficiently high-profile cases you might be right. In general, no way. And that's ignoring that in criminal cases the court cannot even do that, under any circumstances.

And of course, people cheat. Asking the defendant to show this material enables them to cheat. Where do people get this attitude that courts are either capable, or even interested in being the final arbiter of truth in society ? They are not, they have no interest in doing so. They exist to keep the peace, and to keep situations from spiraling out of control. They only enforce the law in a very limited fashion, and this whole absolutist faith in the justice system that so many people have is a fantasy.

People do cheat in court. For two reasons :

1) hubris. Usually, if a case ends up in court it indicates there is more than a bit of ego involved on the defendant's side.

2) the punishments for lying to the court (esp. if it's manipulation along the lines of "we have 5 versions of the requested material, and yes we picked the least bad one), are far less than people think.

> How is this different than any other protected-access evidence material?

The complainant always, always, always, always brings the material and shows it to the court and the defendant.

So it's very different, and very unlikely to work at all otherwise.


> For some reason you left out Microsoft who was also part of that gang who lobbied for EME.

I left them out seeing as at the time they had less than 1% market-share. They did not represent the muscle or deciding-factor which caused Netflix to proceed as they did.

And I did clearly not isolate Google as the sole responsible party. I said they were "one of" the enablers.

All in all, I think my comment holds up well.

> next time you boot windows and load up Edge

Which is why I don't use Edge either. That was easy.


> like the netflix model, a fixed affordable fee

if it's affordable, that means they aren't maximizing value extraction! Think of the unpaid dollars the company could've been receiving, if they only can charge as high as the consumer can afford!


They're charging consumers as much as they can. There was a backlash when they tried to raise rates. They ended up without enough revenue to get the same catalog from content owners that were increasingly wary. I'd pay a few dollars more if I could expect any movie I looked for to be available, but other consumers disagree so I can't. Some of the in house entertainment they produced in response is good though.


Is having non-standard DRM-enablers really any better?

There is a real need for DRM, people and companies are asking for it, it's not going away.


Let's make an intellectual exercise.

What would happen, if these companies would not get what they are asking for?

- Would the companies go back to distributing disc? Hardly.

- Would they make their own clients? Probably yes.

And the difference wrt today situation would be what?

1) The browsers and standards would remain clean - unlike today.

2) Only supported devices and platforms would be able to play videos - Just like today.

3) If you wanted to play DMRed video, you would have launch separate application. In my eyes, that's acceptable price to pay for 1)


> 3) ) If you wanted to play DMRed video, you would have launch separate application. In my eyes, that's acceptable price to pay for 1)

It's a price I'd be willing to pay, but as a Linux user, one that I usually can't pay because few organizations care enough to write applications for Linux. Before it was supported by Chrome, If I wanted to watch Netflix, I had to use a brittle set up that involved Wine, a dodgy PPA, Silverlight, and a fake User-Agent string to pretend to be Windows. I jumped onto Chrome Canary to get Netflix support DRM at the earliest opportunity. I have no idea what I'd do today since Silverlight has been discontinued.

I can understand why people wouldn't want to use Chrome with DRM, but I cannot understand why anyone would say it shouldn't exist/no-one else should use it. A sufficiently motivated person belonging to the first group could possibly create and maintain a patchset to keep Chromium DRM-free.


Not sure I agree on this.

I don't think DRM is great (hate it, actually), but I do understand why the content companies would want it. If I were a content owner I would want to use some sort of DRM system as well, even if it's easy to circumvent.

Does it really matter whether DRM is enabled in Chrome? It has to do with ease of use more than anything. I don't like it, but I don't see how not including EME is good for the end user, if the alternative is having to install a secondary app.

You should want the whole process to be as frictionless as possible, even if that means giving up "amazing code quality" or "a beautiful standard". You can have great code and a crappy app. I don't think the world needs more crappy apps with great code.


Sure they want it, if I were content owner I would probably want it too.

From my POV, DRM enabled Chrome matters. It matters, because

- it makes browsers that do not include DRM uncompetetive (especially those who have another business model or do not have bizdev capabilities of Google, Microsoft or Apple).

- it taints the standards and,

- sets the expectations or baseline for having the DRM available.

If the alternative would be to install a secondary app, things would be more obvious:

- that there is a price in developing, maintaining and supporting DRM,

- that price would have to be paid for those who wish the DRM,

- having DRM available would not be seen as automatic,

- you could not use bizdev capabilities in DRM to be able to push your browser - i.e., only Edge supports Netflix in FullHD (Chrome only in 720p). Yes, the official excuse is that Edge supports DRM X and Chrome only DRM Y, but in the end, it is only a business deal that DRM X is deemed acceptable for FHD and DRM Y is not.


> you could not use bizdev capabilities in DRM to be able to push your browser

How is another browser different from a "secondary app"? It's the same thing.


Rather, we would still be using Flash or Silverlight with its security risks. The current situation is imo better than what we had 5 years ago.


I have no problem having DRM associated with security risks... More people would think about it, whether they really need it and would question providers using it.


Or they'd continue to rely on Flash on platforms apart from iOS.

Some of the motivation for EME is a power-play to kill Flash while replacing it with something browser vendors have control over (and therefore the exploit surface, quality of implementation, etc).


Relying on flash would be fine.

The DRM-ed content would gain an image of being something obsolete, with association with Flash. It would be something to get rid of eventually.

Meanwhile, with EME, it gets an image of modern, something to keep for the future.


You are confusing rights management and licensing with its technical implementation.

DRM will never go away. Licensing and access is a core part of distribution and even more important now with digital everywhere.

It is far better to have a central standard and streamlined experience today rather than try to maintain a "clean API" which nobody cares about while continuing the terrible performance and security of external plugins.


Note that there is no standard for the DRM itself. You can't play Netflix using W3C's specs.

The EME standard is only a JS API for launching arbitrary and deliberately non-standard DMCA-protected Content Decryption Modules (which are like plug-ins, but bundled with the browser).

In this regard EME is even more closed and less standardized than Flash and Silverlight were. The de-facto NPAPI was at least known and could be used by anyone. Now the CDM API is a vendor-specific DMCA-protected secret.


But, unlike Flash and Silverlight, they actually work well out of the box in for example Chrome and Safari. That's a first.

If the alternative is installing a secondary app, I'll take embedded DRM any day of the week.


We've traded freedom for convenience here.

You used to be able to integrate playback with any browser you like. Now you can only watch Netflix in browsers that have a contract with a Netflix-approved CDM vendor. Netflix now has both legal and technical means to control what browsers are allowed to do, and they can prevent you from using an open-source browser to avoid it.


We sure did. But for that same reason I often prefer using a commercial product with a limited functionality subset vs an open source equivalent which supports literally every feature imaginable. Convenience. It just works for what I need it to do.


> Is having non-standard DRM-enablers really any better? There is a real need for DRM, people and companies are asking for it, it's not going away.

>it's not going away

"Powerful people are forcing it on everyone, therefore it's good."

Sorry, not buying it.


DRM is physically impossible. In order to enjoy content, at some point in the delivery chain, it must be decoded to a human readable format. There may be a desire for DRM, but there is also a desire for time travel.


Locks are physically impossible by exactly the same argument. In order to enter cars and homes, at some point doors must be opened. The fact that people have managed to circumvent locks hasn't made them any less desirable -- the mere act of making it difficult, if not impossible to circumvent has value.


This assertion is just wrong. It's wrong in at least 4 ways, but I'm only going to give one, because I think you should be working this out on your own.

The reason people don't take advantage of the time when my door is open is because of the active security measures at that point. In particular, I am present, I represent a reasonable amount of security just by being present, and the law is also present. The reason that theft is rare is because theft is illegal, and confrontational, not because theft is hard.


People who want to burglar somebody's car or home are generally smart enough to wait until there isn't anybody in them, so I'm not sure what presence has to do with the issue. It's kind of beside the point of the analogy anyway. The point is if you can open a locked door with a valid key, a skilled person can get past the lock with their lockpicking tools, much as hackers can get through DRM. But in both cases, casual unauthorized access is prevented.


Very little in this world is based on absolutes. It's all about the relative costs of one thing vs another.


people ... are asking for it

where? No sarcasm, genuinely interested


Content creators are people, and some are asking for it.


Technically you are right, I read it as in consumers are asking for it.


Yes. It forces the costs of supporting DRM primarily onto those who want to use it, rather than primarily on the browser vendors.

As it stands, it is now legally impossible to create a fully standard-compliant web browser without paying licensing fees. That's a huge problem.


Sorry, but that is simply not correct. You can implement a fully standard-compliant web browser by just implementing the ClearKey option. That has no patents associated with it.

It is likely a much better issue that H.264 is the dominant video standard used, and that requires paying licensing fees.


That's a separate issue, though; you could (at least theoretically) have a fully patent-unencumbered DRM standard.


It's not about patents. It's about closed source blobs. Sure you can write an open source DRM module but good luck getting Netflix to support that.


I was responding specifically to the point the GP post made about licensing fees.

What I meant was that there's no reason that there couldn't be a form of DRM that wouldn't require "licensing" in order to use it. It would indeed still have to be a closed-source binary blob—because, like you said, Netflix wouldn't accept anything less—but it could be a freely-redistributable closed-source blob, that any browser would be legally in the clear to include without seeking out a licensing arrangement.

Re: "it's not about patents"—while other IP laws (e.g. copyright) determine whether you have the right to just redistribute a copy of the DRM blob, patents determine whether you can reverse-engineer the original blob to make your own blob with the same ABI that embeds the same keying material, or whether that's also illegal. Patents, thus, are the ultimate difference between a blob you have to pay to license, and one you don't.


Why would anybody make closed source, freely distributable blob in the first place? Making zero money from it, but assuming responsibility for support (both client and server side) AND legal responsibility when hacked? Plus doing business development, in order to gain acceptance at all?

I'm afraid you are asking for unicorns there.


I've done some work on this last year -- it's possible to integrate with the Widevine PPAPI component (DRM library) included in Google Chrome to support decoding Netflix videos in any type of app.

Not legal to distribute though, I think.


Have you heard of this thing called Flash? Or Adobe Acrobat? Silverlight? MS Edge? Uber (the app, and incidentally actually/metaphorically Unicorn)? Google Maps? Netflix for iOS?


Flash is not free. Flash Player is. Flash is actually for-money product.

Adobe Acrobat is also for-money product. You probably meant Adobe Reader, which is similarly positioned to Acrobat like Flash Player to Flash.

Silverlight was and Edge is a way for Microsoft to prove value of the Windows platform, and in case of Silverlight, also of Microsoft developer tools.

Isn't Uber, the app, a way to sell services? Doesn't Netflix for iOS sell Netflix subscriptions?

Isn't Google Maps, together with all Google apps, a way to keep people online, use Google Search... and provide Google audience for ads?

Neither of these would be true for a free DRM. Just like Flash player was financed by selling Flash, Reader by selling Acrobat, Silverlight by selling Visual Studio, Edge by selling Windows, Uber and Netflix by selling services, Google apps by selling ads - what would you be selling in order to provide freely embeddable DRM binary? And tangent question, how would you build your brand?


I'd be giving away the client for my streaming service.


A coalition of the browser manufacturers, just to have one?


Firefox turning itself into a pale imitation of Chrome helped Google do this.

It's not fair to put all the blame on Chrome users. I don't want to use Chrome, but I really don't want to use Chrome's ugly sister Firefox. I held out on Firefox 28, faking a later version in the user agent, as long as possible. Eventually too much of the web no longer worked, so I had to abandon ship.

All major browser vendors are in a race to the bottom to remove as much flexibility and configurability as possible from their users.

We can't win no matter which browser we use, so it's only going to keep getting worse.


I've been using Firefox all these years and I didn't realize there were parts of the web that I couldn't use. Which sites don't work with Firefox?


Many sites broke with Firefox 28 due to missing features.

Most sites added version checks and would bounce you to an "update your browser" screen, but most worked just fine by faking the user agent version.

Sites like Dropbox, Patreon, etc would fail to render though. The version hack had the sites trying to use features it didn't really support.

Version 29 was the first to turn the UI into a Chrome imitator, and "Classic Theme Restorer" never got close to matching the actual look and feel of version 28. Especially not on Linux/BSD. I also resented having to use a bulky extension (that will stop working when Firefox drops XUL extensions) just to change really basic UI options like "don't put refresh on the right-hand side of the address bar."


What specifically bothers you about Australis? I hate what it did to tab layout, but that's the only part that's chrome-like and can be fixed with a bit of CSS, no extensions at all. It set up a new weird one-button menu, but firefox already had a weird one-button menu, and they never removed the ability to use the normal menu bar and ignore the button. And that menu is less chrome-like than the one it replaced.


Let's see ...

I want a regular title bar in my application with the full title of the current tab.

I don't want rounded curves on my tabs. I'd rather they just look like normal tabs.

I want the tab bar beneath my address bar. Australis removed tabsOnTop=false.

I want back and forward to be separate buttons, and not integrated into the address bar.

I don't want the refresh button on the right-hand side of my address bar. I want it after the back/next buttons.

Firefox 28 with tabsOnTop=false is what I want. Classic Theme Restorer gets me there, but with rendering issues, especially on Linux/BSD. And Mozilla already has plans to kill it when they remove XUL extensions.

None of the Australis changes increased usability. They just changed things for the sake of it, and took away a lot of flexibility in customizing the UI layout. I have a lot of difficulty changing up the way I use programs. I've had the same browser layout for 15 years. Nothing wrong with it. I don't want to retrain muscle memory all the time because some designer at Mozilla was bored.


You would love Pale Moon.

https://www.palemoon.org/


I'm not the kind of "works on my machine" developer so I'm sure that if this was your experience something actually happened. But what?

Firefox 28 is from March 2014. I don't remember sites suddenly stopping working at any time, so it could be that I'm not using some of the features you started missing. Which features did Firefox 28 remove or which missing ones in FF went mainstream on so many sites 3 years ago?

Firefox 28 release notes https://www.mozilla.org/en-US/firefox/28.0/releasenotes/

I really don't remember any "update your browser" prompt with Firefox since when web sites were insisting to support only Internet Explorer 6 and Firefox was starting to take off.


I think you misread. It's sticking with firefox 28 for years that lead to problems with sites. There were no problems when firefox 28 was new.


If this is the case then yes, skipping 3 years of new features might break many sites. That's should be expected.


when was the last time you used Firefox? it's pretty good these days.


The policies of ramming stuff down the throat in order to please a mythical user (and failing) are still at full swing at Mozilla.

Now they are removing their strong advantage (extensions) in order to improve their weakness (perceived speed) at full speed. I fully expect them to succeed at first and fail at the second, bleeding users in the process.


Version 41.

List of misfeatures off the top of my head, in rough order of annoyance:

* Australis GUI (Chrome clone) [1]

* Loss of tabs on bottom (Chrome has this issue too) [1]

* Ads on home screen [2]

* Forced integration of extensions I don't want (Hello, Pocket) [3]

* Plans to kill XUL extensions and instead use awful Chrome extensions

* Forced code signing to install extensions (Chrome has problems here too)

* Support of EME, or DRM (Chrome has this issue, too) [4]

* Bloated dropdown list of matched sites when typing in URL bar [5]

* Removal of option to not keep download history [6]

* Burying of countless options (like Javascript permissions) into about:config

[1] I won't even be able to use Classic Theme Restorer once XUL extension support is removed.

[2] I hear these may be gone now, but that it was ever implemented concerns me. I do not want adware in any software I use.

[3] I hear Hello is gone, but Pocket is still there.

[4] I don't care about Netflix. Mozilla betrayed their promise of an open web by caving on this front.

[5] It used to take one line per match. Now it has this multi-line mess that takes up far more screen space to display the exact same amount of information. Oldbar extension restores this, but will break like Classic Theme Restorer soon.

[6] unless I also turn off no browsing history. But I want browsing history. There used to even be an about:config option you could add (browser.download.retention) to restore this behavior, but they removed it.

Overall, it's just the complete and utter disregard by the Firefox dev team for their user base. Every single issue I've mentioned has had lots of bug/feature requests, begging the developers for options to do things the old way. All of them shot down completely.

If Firefox wants to keep turning itself into Chrome, then I might as well use Chrome. At least Chrome is faster and doesn't ship with Pocket.


Most of these problems can be worked around for now - see http://fixfirefox.com

However, given that Mozilla is hellbent on breaking all addons (really the only thing they have going for them) because newer is better or something, I can't really blame anyone for deciding their time is too valuable for staying with a demonstrably insecure browser with questionable development direction.


I've been using Firefox as my main browser for a while but will most likely switch to Chrome soon. It's laggy and loads some common sites very slowly (eg Amazon). That's with e10s enabled and only a few common extensions that, in theory, should make it faster (uBlock, NoScript).

I really want to stick with FF but when text fields lag and Amazon pages take 10 sec to load it's just not a good choice.


The alternative is not watching Netflix in Chrome.


So much for "but DRM plugins are the better solution, because you can decline to install them."

eg https://news.ycombinator.com/item?id=7058004

This is exactly why 'slippery slope' arguments are not as fallacious as people make them out to be. Humans are not rationally acting robots. Spreading out an unacceptable change into a series of gradual and individually acceptable changes does work (even though logically it shouldn't), because it slowly shifts people's baseline expectations.


> This is exactly why 'slippery slope' arguments are not as fallacious as people make them out to be.

"Slippery slopes" are only fallacious when you don't actually describe a mechanism from reaching the top of the slope to the bottom.

"If we let women vote, next thing you know there will be gays in the military." That's fallacious because there's no connection at all between women's sufferage and gays in the military. Many slippery slope arguments take that form.

"If we allow DRM plugins, we will eventually have DRM in the browser always on," could be considered fallacious because it's not made explicit how one gets from DRM plugins to DRM always on, even if it may be implicitly obvious.

"If we allow DRM plugins, we will eventually have DRM in the browser always on because that is the endgame Netflix et al wants and they are spreading out the implementation of their evil master plan to gain compliance" isn't fallacious as a slippery slope because the mechanism is made explicit.


It doesn't work like that.

"Slippery slope" is, by itself, a mechanism. It means exactly what you're describing in your last paragraph, except it does not require someone explicitly planning the progression.

"Spreading out the implementation..." does not improve the argument because it's just restating the definition of "slippery slope". The statement that Netflix has some "evil master plan" is an assertion without proof and doesn't add anything to the argument, either.


I'm sorry, but I think you're simply incorrect.

The premise that Netflix is acting with mallace could be false or true. If that premise is stated and false, then the argument is valid yet unsound because it has a false premise. Valid meaning, the conclusion would follow from the premises if all of them were true.

If you remove discussion of the mechanism from the argument, so that it reads like the arguments stated in the first and second paragraphs, then the argument is invalid because the conclusion does not follow from the premises. That's what a fallacy is.


This concept is being called either boiling frog https://en.wikipedia.org/wiki/Boiling_frog or Overton window https://en.wikipedia.org/wiki/Overton_window (in political sciences)


This was an oversight not removal. If you read the bug report they have already resolved this by putting the option in another place to disable this.


My favorite story about DRM is how even Netflix's CEO would rather not use DRM but basically less than 1% of the users care about DRM while it's a requirements when signing contracts with movies producers.

This makes perfect sense, and at the end of the day those who produce there content have a right to choose the conditions of how it's distributed


> My favorite story about DRM is how even Netflix's CEO would rather not use DRM

On which I call bullshit. They still use it for their own productions and series.


> On which I call bullshit.

Why? DRM adds cost and complexity to Netflix's operations. I bet a not insignificant number of customer support issues are related to DRM (e.g. bad drivers).

> They still use it for their own productions and series.

Because that's what their platform is. The vast majority of their content remains licensed, and that licensed content requires DRM. They'd have to run a largely different platform just for their own content to be DRM free and now have customers with inconsistent experiences depending on which content was displayed.


Sure. But that doesn't mean the W3C had to compromise the Open Web by incorporating DRM interop into their standards.


> and at the end of the day those who produce there content have a right to choose the conditions of how it's distributed

Sure, but also Netflix and other distributors have right to choose what they distribute and what they don't distribute. So a few movies would not be available, until the studios do the math and stop insist on DRM.

Instead, they managed to outsource the support burden for their wish and it is financed by third parties, who don't care about DRM at all.


Not 'a few' wouldn't be available but even less than there are now. Then even more people will complain about the small catalog of movies and series on Netflix and leave their service. I am not sure about the American catalog but the one in the netherlands is not so large.


Netflix has this problem almost everywhere.

They are solving it by making their original content and there surely is not DRM enforcement by third parties.

In the end, it is about who can persuade the other party about their own relative importance in the business.


I dropped Chrome few weeks ago when this news initially appeared. I've been using Firefox and haven't looked back at Chrome since.

I've been a Chrome user since its earliest releases. I remember switching away from Firefox at the time because Chrome seemed faster on my old PC, and I also loved the minimalistic design. Now I feel Firefox has an edge again, and I also get to supported a company whose values are apparently more aligned with mine. Go Mozilla!


Chrome has the best dev tools. Until that is sorted we will be tied.

I use Safari most other times. Never Firefox though


They are trying .. http://devtoolschallenger.com/ .. I don't know what else you'd want (because I'm not a frontend guy and I can see how slow the backend shit is from the server log just as well thankyou :) )


I use Chrome for when I need the dev-tools and nothing else. I don't like to promote evil browsers.


It's a shame this garbage made it into HTML standard, and Google were complicit in it.


Better than using flash, which Spotify Web player used to do.


not really. flash is dying, and osx devices is probably going to stop supporting it soon enough, and the rest of the world is going to follow. if DRM isn't in the standard, it illegitimizes any DRM that you have to install, which improves content consumption for users, and hopefully force media producers to use DRM free formats, even when they don't want to (they cannot realistically ask users to install a blob without taking a hit in signup and conversion).

however, if DRM is built-in to the browser, users no longer have a gate to cross, and so DRM media will become the norm.


More likely what would happen is that DRM'ed content is only available on mobile devices and Windows. If you think that not having DRM in the browsers would cause anyone to abandon it, you are wrong.


DRM-free can be achieved. But for that we don't need betrayals like Google's and the like. They only delay things.


The difference is, you can, and always were able to disable Flash. Now all that that shit is part of "HTML" and you can't throw away that kitchen sink anymore. Have fun with buggy DRM binary blobs and obscure HTML standards leaking your internal IPs.


> obscure HTML standards leaking your internal IPs

Like WebRTC? That finally allowed me to uninstall Skype?


I dunno. Back in the Flash days I could guarantee that pretty much any video would play in my browser. Nowadays I have to switch browsers to watch an embedded video on Twitter, for example.


With Firefox constantly shooting itself in the foot and Google being it's usual evil self we are slowly but surely moving into the dystopian future of walled internet. Oh well.


Isn't Firefox progressing nicely?


If you have great product you don't need DRM, you will make money of it either way. Look at CD Project RED (creators of Witcher game series), their CEO said "We can't force you to buy our game but we can convince you to do so" and they don't use DRM because they choose to. They made a lot of money because they just care about their product and their clients.


So all we need is a powerful enough GPU and record the screen while playing a "DRM-enabled" movie?


This doesn't actually work. Try it!


How? Do cameras detect DRM contents?


You’re joking, but yes, that’s actually a thing.

Watermarks with detection in cameras and scanners, be it the simple EURion constellation[1], ContentArmor[2] or the watermarking techniques developed by Denuvo, these things exist.

Some directly prevent you from photographing the content or filming it, others tell the camera to add identifying information steganographically. Even others are only used for ContentID. All of them work even if the material is going through analog copying.

[1] https://en.wikipedia.org/wiki/EURion_constellation [2] http://contentarmor.net/


Also [1], which relies on watermarking audio of content, which then can be detected by hardware players and the playback can be stopped if it discovers that e.g. you play a BluRay rip from USB stick. It survives encoding with different codecs. I'm not sure if it has been cracked yet or not.

[1] https://en.wikipedia.org/wiki/Cinavia


Appears to be 'cracked' as far as is possible- i.e, can remove the watermark itself, but not possible to undo the degradation to the original signal that the watermarking introduces.

http://cyberside.net.ee/ripping/cinex_wp_release1.pdf


You don't need a camera. Just buy the right "HDMI splitter" which splits one hdmi signal into several. Some of them, for a seemingly arbitrary reason, also strip off HDCP and then you can just record the clean unencrypted HDMI signal. I obviously can't tell you which exact models to get, but a quick googling will.


Just a question on principles...as someone elsewhere here has stated that this article is out of date and that you can, in fact, disable Widevine in Chrome 57.

But either way, let's say you couldn't disable it...and that it was also the case in Chromium. Couldn't someone fork Chromium and put out a new browser with that disabled? Chromium is all open source, yes? So what's stopping someone from doing that?


Does DRM even work? I can hardly believe, that encryption keys are not leaked and determined hackers can't copy protected content.


DRM works great, but DRM is not for protecting content from piracy. It's for getting leverage over playback device manufacturers.

https://plus.google.com/+IanHickson/posts/iPmatxBYuj2


That's a very interesting point of view, thanks, it certainly makes sense. Though I don't really understand, why bother with all those encryptions, if you can just add some metadata to the video container. Something like "printing is forbidden" flag in PDF.


Usually metadata like "printing is forbidden" or "ad is unskippable" is effectively optional, as someone could write a player that ignores it.

However, adding any encryption covered by DMCA makes it the law, and allows you to use the police to enforce your file format's specification.


Is Chromium affected too?


That's what I'd like to know also. And if so, what is stopping a group of people from forking Chromium and building one that can turn it off? Chromium is open source, yes?

With everyone crying and complaining about Firefox on this thread, why not all get together and fork THAT browser too? There have been forks of software before...some MUCH bigger than a browser. Take MATE forking off from Gnome 2 when people didn't like Gnome 3 at the time. Look at LibreOffice. Why should Chromium or Firefox be any different?


What I don't like about Widevine/EME in Chrome: you don't when it is being used. It would be a big improvement if you knew and could ask the website why it is using EME on something. Of course it should also possible to know for what EME is being used.


EME should be a permissions, just as much as asking for the users microphone and web-camera. Iirc when Firefox caved in on this whole CDM thing, they made it something the website needs to request access to before it can be activated.

I see no technical reasons for why Chrome shouldn't be able to do the same.

I guess Google has an active interest in promoting DRM, and as such making DRM cumbersome to use is counter to that goal.


This is actually the case, but the setting in incomplete, you have a setting called "Allow sites to play protected content (recommended)" in the Settings (Chrome 57).

Missing is "Ask" and a whitelist.


Time to cancel Netflix.


How about a button to disable mandatory Extension updates?


Cool, thanks Google.


I will have to read the article later but if this is true then I will have to say to Chrome those memorable words found in Terminator 2. Hasta la vista, baby.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: