Discussion:
Media Encryption and NPAPI
Gary Mort
2014-07-16 02:35:55 UTC
Permalink
NPAPI is deprecated and should not be used for plug-ins - so I'm curious on what the alternative is for things like encrypted media extensions.

It seems that rather then providing a method for anyone to create plugins for drm enabled media, Firefox is instead providing a single closed sourced implementation based on "DRM requires closed systems to operate as currently required and is designed to remove user control," https://blog.mozilla.org/blog/2014/05/14/drm-and-the-challenge-of-serving-users/

Obviously the above statement is not true, but it seems that instead of providing choice Mozilla has decided to force one solution onto everyone.

DRM protection could be as simple as passing all blocks of media data through a simple circular shift. The only "secret" part of the plugin would be the block size and the rotation size. Sure, such DRM is trivial to break, but then all DRM is eventually trivial to break - so if someone wants mild drm protection they could easily provide a plugin to do so.

However, there does not appear to be an api to provide small compiled bits of code/plugins. Am I missing something or is this really the case?

The ability to have competing DRM mechanisms has, in the past, provided protection from companies that have decided to abuse the need for DRM software to include all sorts of abuses, spyware, trojans, etc.
Chris Pearce
2014-07-16 20:19:19 UTC
Permalink
Post by Gary Mort
NPAPI is deprecated and should not be used for plug-ins - so I'm curious on what the alternative is for things like encrypted media extensions.
https://wiki.mozilla.org/GeckoMediaPlugins

We will use this for OpenH264 and EME plugins.
Post by Gary Mort
It seems that rather then providing a method for anyone to create plugins for drm enabled media,
Of course we can't stop anyone writing code for a GMP, but only GMPs
approved by us will be allowed to run in Mozilla Firefox builds.
Post by Gary Mort
Firefox is instead providing a single closed sourced implementation
How is this different from what other browser vendors are doing?
Post by Gary Mort
based on "DRM requires closed systems to operate as currently required and is designed to remove user control," https://blog.mozilla.org/blog/2014/05/14/drm-and-the-challenge-of-serving-users/
Obviously the above statement is not true, but it seems that instead of providing choice Mozilla has decided to force one solution onto everyone.
DRM protection could be as simple as passing all blocks of media data through a simple circular shift. The only "secret" part of the plugin would be the block size and the rotation size. Sure, such DRM is trivial to break, but then all DRM is eventually trivial to break - so if someone wants mild drm protection they could easily provide a plugin to do so.
That may be how you want it to work, but it's not how it actually works,
due to things beyond our control.
Post by Gary Mort
However, there does not appear to be an api to provide small compiled bits of code/plugins. Am I missing something or is this really the case?
https://wiki.mozilla.org/GeckoMediaPlugins
Post by Gary Mort
The ability to have competing DRM mechanisms has, in the past, provided protection from companies that have decided to abuse the need for DRM software to include all sorts of abuses, spyware, trojans, etc.
Martin Husemann
2014-07-17 08:35:03 UTC
Permalink
Post by Chris Pearce
How is this different from what other browser vendors are doing?
It is actually *way* better than what everyone else does, as users still
have the ability to opt out.

Thanks!

Martin
g***@gmail.com
2014-07-22 04:39:26 UTC
Permalink
Post by Martin Husemann
have the ability to opt out.
It's way better because users have to Opt in, if I understand correctly. If we're only giving users the option to opt out that is not different at all from other browser vendors.
h***@hsivonen.fi
2014-07-28 09:10:04 UTC
Permalink
Post by g***@gmail.com
Post by Martin Husemann
have the ability to opt out.
It's way better because users have to Opt in, if I understand correctly. If we're only giving users the option to opt out that is not different at all from other browser vendors.
Indeed, the plan is for EME-style DRM to be opt-in in Firefox.

AFAICT, it's opt-out on Chrome OS (the Widevine CDM shows up as a plug-in in the same UI that one would use for turning off Pepper Flash). It seems that there's an opt-out UI in IE11 (I haven't actually tested whether it works), but locating it is quite non-obvious. I failed to locate it on my first two careful attempts! (It's in a menubar menu but the menubar is hidden by default.) I haven't taken the time to examine if Safari has an opt-out UI somewhere.
Loading...