Hacker News Reader

Comment by daguava | Hacker News Reader

The part I find scary is it uses Adobe's new Content Decryption Module.

So you mean to tell me the alternative to the buggy insanely insecure Adobe Flash is... more software by Adobe?

It's still a security win, because the CDM sandbox is allowed to do substantially less than the Flash sandbox. Flash can access your webcam, filesystem, make any network connection, etc. The CDM only decrypts and decodes frames.

Flash is a general-purpose virtual machine with a large attack surface, including a JIT and access to the GPU. The Adobe CDM has a tightly-controlled API. Unless Adobe's Flash updater, Firefox manages CDM updates so any CDM security fixes can be deployed to users within 24–48 hours.

Well the DRM software has to come from somewhere and Adobe has long proven themselves to be adept at such things for the most part. Are there alternatives? Is this because of Adobe muscling out others?

I found this [1] interesting:

> Firefox does not load this module directly. Instead, we wrap it into an open-source sandbox. In our implementation, the CDM will have no access to the user’s hard drive or the network. Instead, the sandbox will provide the CDM only with communication mechanism with Firefox for receiving encrypted data and for displaying the results.

So the open-source fix for a closed-source, proprietary CDM is to sandbox it? How is this any different than Flash or Silverlight, really?

[1]: https://hacks.mozilla.org/2014/05/reconciling-mozillas-missi...

But is it guaranteed to be buggy and insecure just because it is by Adobe?

I desperately hope not, my original comment sure appears to come off as rooting against Adobe, but I'll absolutely hope this means success and is the start of secured content playback on HTML5

Having spent 7.5 hours on multiple customer support calls to Adobe just to get a feature enabled (compatibility with a 32 bit system) that was stated ON THE PRODUCT BOX as being present and working... YES!

(Yes, this is a bit OT, but still, "Adobe".)

I also fear the CDM support being used to "lock down" ever more aspects of web content.

And I fear attempts on the part of Adobe as well as others (perhaps in concert with a State or corporate power) to escape sandboxing and do "whatever" on client systems for their own purposes. In other words, here is another binary blob from Adobe (et al.?) that we are supposed to trust.

Sorry, Adobe, but -- through dint of extended experience -- I simply don't trust you.

Reply on news.ycombinator.com