Pipelight: A Way To Get Netflix On Linux

[smitty3268]

But so far there doesn't exist an API in web standards for this to be practical. The EME model allows this in a more practical, less user-bothering way. Why should we make DRM easy? If the content providers want to use DRM, let them pay the cost, let them make it inconvenient for the user. EME is just pushing the dirty work of DRM schemes onto the browsers, instead of having the content providers do it like they should.

I don't understand why you think it's any easier or harder for them at all. It's the exact same thing.

And do you think Apple and Microsoft will just let anyone use their DRM systems for free?

Of course not. Another reason to believe that IE will only ever run MS's own DRM system, and no one else's. They'll want a cut of money for any DRM content they play. Why play nice and allow others to profit instead?

This whole thing just smells like a power-grab. Netflix is now a big deal, they want to prevent future market disruptors and raise entry barriers by making it harder for others to become online distributors. Hollywood, MPAA and the rest demand DRM, and this means new distributors will have to either create their own DRM schemes that satisfy the demands of the copyright mafia, or they will have to pay royalties to Apple/Netflix/Microsoft/Google for using their DRM-schemes.

Welcome to 1999. This is DRM 101.

Yes it does, the spec specifically mentions that there can be arbitrary CDM's.

Exactly my point. There "can" be arbitrary CDM's. Browsers aren't forced to support any, though. Which is exactly why they're only going to support the one's baked into their OS and block all others.

Except that without EME, it would be too inconvenient for them and too inconvenient for the users.

Again, i just don't see any difference. Unless you've got insider information into the way MS and Apple DRM works, then you don't either. How is "updating a binary plugin to a browser" any easier than "updating Silverlight (which is a binary plugin to a browser)"?.

So then we agree that there shouldn't be a W3C spec for this thing, and that DRM shouldn't be a web standard.

Yeah, probably - or at least not if none of them can agree on a single system which will work everywhere (a.k.a. an actual good spec). Unlike you, i just don't see why it matters. If browsers and content providers are going to do it anyway, what does it matter if it's officially a standard or not? Meh...

[Luke]

If you want pay movies

Many have asked why paid content providers using DRM don't support Linux. Well, the way I see it, Hollywood is simply going to tell you to use their pay operating system, one they can control, if you want pay movies. An interesting hack to bypass this against Netflix would be to get IE 11 running under WINE, then see if the HTML5 DRM modules being used in that browser with GTML5 by Netflix will run in that configuration. I can't say, I've never done busieness with with a paid content provider in my life.

Otherwise, if you really need to pay for video, my suggestion is to dual-boot. A good enough hacker might also might be able to crack their DRM by running Windows in a virtual machine under Linux-with the host operating system used to capture the stream to a file. Hell, something like Windows 7/Silverlight over Stoned Bootkit or a descendant of it might be enough without going the VM route, so Hollywood gets no guarantee with any form of DRM simply by requiring a paid, closed OS.

On the other hand, they do know that if they allow their DRM'ed shit onto Linux, the content will be instantly intercepted, and the quality will exceed that of the 1080p camera facing 1080p monitor copies nobody can stop. They will have no way to stop screen capture, as without control over the kernel you can't prevent video screen capture. No custom hyperviser or bootkit required, much less hacking skill, thus far more copies made and faster. Since DRM pisses people off, such copies tend to propagate.

I only know of one DRM scheme that would ever work: Releasing movies only in a huge, high bandwidth format nobody's connection can handle, then getting users hooked on that format's quality or features. Otherwise, forget about it.

If you don't like DRM, boycott all DRM'ed content without exception. Ignore it or pirate it, but never let them have your money.

[GreatEmerald]

My point was supporting it financially. Buying second hand if you really must watch the latest blockbuster gives none of the money to the studio insisting on loading it with DRM, and at least the DRM on DVD's is largely broken. So no, it isn't still "supporting DRM", the studio demanding DRM gets none of the money.

Simply don't pay for services that actively make it difficult for you to use them when you know it's going to the same person trying to make it difficult for you.

They do get the money indirectly. One could say that pirating the movies would ensure they don't get the money at all... And if you need to crack the DRM to watch it, then how different is it from pirating, anyway? No, I'd say not buying any movies at all is the way to go. There is still plenty of DRM-free entertainment, such as YouTube.

[ar17787]

I am one of those weird people who think we should pay for content.... to the content creators. Not some third party whose only means of survival is selling other peoples hard work (DRM). To this end here is what I wish.

All major TV channels (HBO, AMC, SyFy etc.) create a private torrent tracker and load up 1080p versions of all their shows as they are made. I and a number of other people would be very happy to pay for the privilege of using this tracker knowing that our money is going to direct to the creators of the content. My only insistence would be that they provide the show in a container of my choice (in my case .mkv but whatever). I could then do whatever I want with my File at home and move it to be used in any way I wish. ( In my case stream from my fileserver to XBMC)

Movies would work in a very similar fashion but rather than it being the big studios (Warner Bros, Universal etc.) it is the Production companies that host the tracker (Scott Free, Bad Robot etc.) and hence make the money.

This would of course mean that the studios would collapse... and we can't have that now can we

I know it will never happen because these companies, rather than embracing this technology like steam et al. have, have decided that it is evil.

meh I can dream, until then I just torrent everything and get it the way I want anyways it's their fault they are losing my $ and no one elses

just my two cents

[DanLamb]

I don't blame any of them for using Silverlight. With their only real choices being shut down or suck it up, their hands were effectively tied.

The non-PC netflix clients, such as Roku, blu-ray players, integrated into hdtvs, PS3s, don't use Silverlight. The PC version didn't need to use Silverlight technically, but Microsoft probably made Netflix a deal they couldn't refuse, and why not? Now, that the Silverlight web plugin is basically dead, Netflix is planning to move to HTML5, which sounds like a better route for Linux support.

[dee.]

Netflix is planning to move to HTML5, which sounds like a better route for Linux support.

No, it doesn't. HTML5 DRM will not run on Linux unless someone ports the required Netflix-specific proprietary content decryption modules over to Linux. No one will do that, because Linux is an open source OS and open source is ideologically incompatible with DRM.

Open source is about enabling user freedom, DRM requires the exact opposite.

[erendorn]

No, it doesn't. HTML5 DRM will not run on Linux unless someone ports the required Netflix-specific proprietary content decryption modules over to Linux. No one will do that, because Linux is an open source OS and open source is ideologically incompatible with DRM.

Open source is about enabling user freedom, DRM requires the exact opposite.

• It seems that Windows does not prevent screencapturing DRMed content (see here).
• I'm also pretty sure that non-free/binary-only applications are completely accepted on Linux.
• Netflix are the ones that would develop their DRM module, and they don't care about ideological incompatibilities.

Linux being an open source OS has nothing to do with the potential lack of Netflix-specific proprietary content decryption modules.
The reason is simply market share vs development costs.

[dee.]

• It seems that Windows does not prevent screencapturing DRMed content (see here).

Not yet, you mean. Google "trusted computing platform" (formerly known as MS "Palladium") and you'll know what I'm talking about. You think MS has given up on building their "trusted platform"? It's their age-old dream. A system where DRM is hardcoded in the OS and hardware. There are already dual-domain systems where there's a specific second "tamper-proof" CPU for handling DRM content, which has direct access to the GPU in a way that the non-trusted CPU cannot access the data.

• I'm also pretty sure that non-free/binary-only applications are completely accepted on Linux.
• Netflix are the ones that would develop their DRM module, and they don't care about ideological incompatibilities.

And you think Netflix cares about Linux because...? It doesn't even matter if it's equally possible to do screencaptures etc. on windows - it's the perception of the content producers that counts. If they see Linux as a threat, they will not allow their content to be viewed on an "unsafe OS" (ie. an OS that contains such unsafe elements as user freedom, after all, "user is adversary" is the main thesis of DRM). They find it much easier to convince the providers of closed operating systems to implement a "trusted platform" that provides a "secure" connection from the DRM module all the way to the screen.

That's the microsoft's and their hollywood/mpaa partners' dream: a "trusted" OS on hardware that contains a "trusted platform module" or somesuch "tamper proof" DRM blackbox, allowing content to be streamed from the web with DRM in every part of the chain. The "trusted" browser (IE) downloads content from Netflix or such, uses a "trusted" CDM to interact with the TPM, which decrypts the stream and re-encrypts it with the HDMI DRM, sends it to GPU which just sends it via a "trusted" HDMI connection to a "trusted" monitor.

Of course this DRM can be broken and partly it already is, but the thing is, that doesn't matter to hollywood, because the real purpose of DRM is not to prevent piracy... it's the stated goal, but in reality DRM is probably aimed more against regular users. It's a way to force users to make redundant purchases. They want DRM schemes to force you to buy several copies of each movie and song and book. From there, it's just a small step until we all get chips installed in our brains that alert the authorities if we see content we haven't paid for... or alternatively, automatically deduct a fee from our bank account whenever we watch "protected content"...

Linux being an open source OS has nothing to do with the potential lack of Netflix-specific proprietary content decryption modules.
The reason is simply market share vs development costs.

That's one reason, sure.

[Luke]

Boycott locked down/DRMed hardware too

There are already dual-domain systems where there's a specific second "tamper-proof" CPU for handling DRM content, which has direct access to the GPU in a way that the non-trusted CPU cannot access the data.

<clip>

That's the microsoft's and their hollywood/mpaa partners' dream: a "trusted" OS on hardware that contains a "trusted platform module" or somesuch "tamper proof" DRM blackbox, allowing content to be streamed from the web with DRM in every part of the chain. The "trusted" browser (IE) downloads content from Netflix or such, uses a "trusted" CDM to interact with the TPM, which decrypts the stream and re-encrypts it with the HDMI DRM, sends it to GPU which just sends it via a "trusted" HDMI connection to a "trusted" monitor.

The countermeasure to this is obvious: refuse to buy any current hardware sold with DRM that is difficult to crack. That includes locked down game and TV consoles that can't run free software without a "mod chip" or other hardware modifications. It includes any laptop or tablet whose implementation of "secure boot" prevents running Linux due to a nonstandard key, no unlocked and no legacy mode, a bug in UEFI, that string search for Windows or RHEL one vendor inserted, etc. It especially includes all iOS hardware and all of those ARM Windows RT tablets.

If locked down devices share the fate of the original Windows Surface r/t, and people won't buy them, that will at a minimum keep some vendors producing unlocked hardware, just as many ARM tablet makers don't sell Windows or iOS devices. A strong boycott of locked general purpose PC's could confine hardware DRM to machines intended for use with television sets instead of as desktops. I don't care if no cable TV operator would dare connect to my desktop!

A "Dual Domain" device, even it it can run free software with the DRM hardware "disabled" is not to be trusted and therefore should not be purchased. That much computing power out of the users control is quite dangerous, like a running cellphone on the table where a meeting hostile to law enforcement is conducted. In fact, it can be deemed a cellphone inside your computer that you can "turn off," but can't remove the battery and still run the rest of the machine.

How do we know it is really all the way off when an unsupported OS is running on the main CPU? To me, a fundamental principle of trust in computing is that no one device or program can be simultaniously trusted by two parties who are adversaries, barring the possibility of rigorous third party audit of all functions. Anything undocumented and beyond audit automatically makes it untrustable for all adversaries of the manufacturer or of any of the manufactorer's allies.

[dee.]

The countermeasure to this is obvious: refuse to buy any current hardware sold with DRM that is difficult to crack. That includes locked down game and TV consoles that can't run free software without a "mod chip" or other hardware modifications. It includes any laptop or tablet whose implementation of "secure boot" prevents running Linux due to a nonstandard key, no unlocked and no legacy mode, a bug in UEFI, that string search for Windows or RHEL one vendor inserted, etc. It especially includes all iOS hardware and all of those ARM Windows RT tablets.

Yeeees, the thing is - boycotts only work if you get enough people to go along with them.

I'm seriously hoping that this whole NSA deal will get more people pay more attention to security and privacy of their hardware (and software). Otherwise, we're in for a grim future.

There is, however, another answer: open hardware. CPUs, GPUs and motherboards developed by open source methods, with all the plans, chip logic, etc. available under an open source license such as GPL. Compatibility would be a problem, of course, so the CPU might have to be compromised, but there will always be non-crippled CPUs simply because they are needed for so many non-consumer applications. We may just all have to start using architectures like PowerPC or such...

How do we know it is really all the way off when an unsupported OS is running on the main CPU? To me, a fundamental principle of trust in computing is that no one device or program can be simultaniously trusted by two parties who are adversaries, barring the possibility of rigorous third party audit of all functions. Anything undocumented and beyond audit automatically makes it untrustable for all adversaries of the manufacturer or of any of the manufactorer's allies.

True, another reason why we need open hardware. We need hardware where the primary trusted party is the user, and not anyone else.