Hacker Newsnew | past | comments | ask | show | jobs | submit | Mindwipe's commentslogin

They have a business presence in the US, and sent it there.

It isn't, it's just an open source library to talk to the closed source Widevine plugin included with Chrome, or, in this case with keys illicitly obtained from a broken Google plugin that they haven't revoked yet.

There were some open source white box cryptography attempts fifteen or so years ago and they didn't work because of precisely what you say.


Thanks that makes more sense (and is also a bit disappointing!)

There's literally already signal on half the Underground, has been for six months to a year, and as someone who gets the tube twice a day I've literally never seen someone do voice call. Literally ever.

Chrome on Windows now has 4K support (if you have the supported hardware).

> I'm hopeful that some day Linux will have enough users where the media companies can't ignore them.

The entirety of personal computer viewing doesn't have enough users where the media companies can't ignore them.

Fundamentally higher resolution playback happens on platforms like Windows and MacOS because they have closed, signed driver stacks, same as anti-cheat in games. Not because of the browser. So it will only ever happen if someone forks Linux to a more restricted, closed browser stack and offers that as a product (which is basically how a cable set-top box works in practice).


No they aren't.

This is an internet myth pushed by certain sci-fi writers doing incompetent research.

Disney were certainly in favour of the US's most recent copyright extension, but the main driver of it was the need for the US to move to a similar period to the EU for international treaty reasons.

The EU had moved to Life+70 years as a model because it unified to the longest period in the block when it unified the copyright period across the entire EU, under the logic that no copyright owner should have their term reduced as a result.

The longest period in Europe was Germany, and Germany's long copyright period was the result of lobbying from local German publishers, nothing to do with American companies.

It's really a bit of US exceptionalism to think Disney had much to do with it.


The parity excuse is always trotted out, but notice that nobody actually does parity. That US law doesn't deliver the same thing as the existing EU law, it just increases all the US limits with "parity" offered as justification.

That's on purpose to allow the same parties (if not called out by the public) to run to the EU to demand more "parity" increasing the EU limits too. Back and forth forever.


Regardless of whose fault it is, I think copyrights are too long. I think they were considerably more appropriate before the copyright extension act.


I'm not sure that this is correct. Spain used to be life+80 (a copyright term that dates back to 1879) and this got reduced to life+70 (but only for authors who die on or after late 1987, so this is a long way from affecting PD status) with EU-wide rules.


the exact details of EU copyright rules and lengths are probably difficult to work out, at least as difficult as saying what the laws are regarding what constitutes a felony in the United States, since that really depends on what state you're in.

But I would have to say that yes, it is mainly the EU that drives longer copyright, because EU copyright is not based on a model of doing things to help society but because there is a moral right of ownership that is possessed by the creator of a work. This of course explains why often something is out of copyright in the U.S but still under copyright in the EU but I don't think I have ever heard of the reverse applying (I'm sure HN can come up with an edge case though)


The situation with public domain in part because most US government works are public domain and PD isn’t even possible in some European countries—related to moral rights.


He genuinely might not know. I worked on a similar incident when our video encoder caused about 30% of a pretty mainstream mobile handset to hard lock when recieving a stream, requiring the battery to be removed to reboot the device.

Neither us nor the OEM ever figured out why. They suspected that it was a weird combination of different bin combinations from different parts, but ultimately we had to change the method of delivering video to stop it happening.


The Dutch broadcasting service hired me to figure out why their homepage was crashing browsers. I turned out to be an animated GIF of two speakers that had an extra 0 interval frame in it which caused IE to crash... it doesn't take much.


YouTube Music uses Widevine.


If it's on YouTube Music, it's also on... YouTube.


Not necessarily at the same quality though.


I assume in most cases they're literally the same files. Youtube runs "topic" channels for music that distributors have sent it.

https://www.youtube.com/channel/UCYOa-hi751OKY2zGJJv6V2A

https://www.youtube.com/watch?v=MSSxnv1_J2g (same thing, but on an official channel instead)


You can load any youtube music song on youtube by just removing the "music" subdomain.


Then why do you say they might not be the same files?


Let me start over. Youtube itself has DRM required for certain videos, and certain formats of videos.

The 256 kbps format for music will be protected by DRM. If you do not have DRM available youtube will fallback to a lower quality format to play the auduo.


Music might have higher quality audio-only files as provided where Youtube might have it combined with video and a generic compression algorithm applied as with all other uploaded videos.


Really great article.

I also think there's still an enormous ignorance from passkey devs that lots of people want to occasionally log into personal services from locked down corporate machines, and the flow to deal this is at best terrible but more often non-existent, and developers with typically enhanced privileges just aren't able to conceive how difficult this is.


Logging in to a personal service from your locked down corporate machine with a passkey works like this:

1. Start to login to the site.

2. When it gets to the point that you would choose to use a passkey if you were logging in at home, there should be some option that lets you say you want to use a passkey on another device. You can use that to tell it you want to use a passkey that is on your phone.

3. It gives you a QR code to scan with the phone, and then you complete the login using the passkey manager on the phone.


This is one of the core use cases for why FIDO Cross-Device Authentication was created. To be able to use a passkey to sign in on a shared device, a device you don't control, or a device where you just need temporary access to something.


On the one hand, that seems really important and I'm happy to know it exists.

On the other hand, I thought I had fully researched how passkeys work and literally never came across it.

So it kind of just continues to support my concern that passkeys are just too complicated to understand. If I'm at another device I need to log into, I would have just assumed I couldn't.

There needs to be a simple mental model for users. I'm not saying passkeys can't underlie that, but I think the UX still just hasn't been fully figured out yet.


I used the technical name for the capability, but you've likely run into it before.

If there is no passkey on the local device, a QR code will appear which you can scan with your phone or tablet, and use the passkey for the account from that device. It just kind of happens, typically without the user having to do anything special.

I will say though, corporate devices can be a bit of a wildcard as they are usually configured and locked down for a specific purpose. But the cross-device flow is generally not blocked by organizations.


I don't use passkeys, so I haven't run into it. It seems like that screen would be gated behind entering an e-mail address or username that is already registered with a passkey on another device.

What I'm saying is, I thought I had the right mental model of how passkeys work, after researching them, and that mental model told me you wouldn't be able to log in on a different device without going through a whole procedure to set up a new passkey, which you wouldn't want to do for something temporary.

The mental complexity is just too much for me to trust that if I adopt them, they'll work when I need them. The fact that I got this thing wrong means there's probably other things I'm still getting wrong.

I understand passwords and password managers and even 2FA. I feel like I can plan how to use them right so it all works and I don't need to worry about not being able to access my accounts. I just don't have that confidence with passkeys.


> log into personal services from locked down corporate machines

This is usually a bad idea, and is sometimes expressly forbidden.

But. more generally, there must be a flow for accessing your account when the passkey is not available, and possibly cannot be recovered.


I'm limited in what applications I can install at work. I am not limited in what websites I can access on my lunch break (within reason).


This is one of the core use cases for why FIDO Cross-Device Authentication was created. To be able to use a passkey to sign in on a shared device, a device you don't control, or a device where you just need temporary access to something.


Just tried that.

Logged into Passkeys.io on my phone, and created a passkey.

Then tried to log in to it on my Windows desktop, using the "With my phone" option. First time around it failed to connect to my phone. Future times it connected, but told me that the phone had no appropriate passkeys on it. At which point I gave up.

Edit: I then tried on GitHub, and it worked perfectly! Okay, that's pretty awesome.


As someone who has enhanced privileges, I'm having problems thinking of what all the the issues here are.

Corporate installs disable all USB functionality, and remove the ability to sync profiles? Something like that?


If you’re not using bitwarden or equivalent they can’t be moved off a device you own at all, and even with it you’d need to download bitwarden which might be impossible


You can literally click to boot into "dumb mode" on all modern Google TVs such as Sony once and forget about it.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: