Re: "Revealed: how Microsoft handed the NSA access to encrypted messages"

On Fri, Jul 12, 2013 at 1:04 PM, piranna@gmail.com <piranna@gmail.com>wrote:

> > Just to re-iterate, the intention is that the closed software comes
> > from, or is at least well understood by, your browser implementor or
> > your OS implementor.
>
> So, since Mozilla and Debian have the condition of the source code of the
> all software they offer is available as open source, they will not be able
> to access it to offer it to me, so I will not be able to access EME and CDM
> protected content if I don't trust a third party capable of offer me that
> support. Oh, well...
>
We have a relevant open bug on the EME specification, noted in the
published Working Draft (
https://www.w3.org/Bugs/Public/show_bug.cgi?id=20944). Robert O'Callaghan
of Mozilla proposed that all CDMs be registered and that a condition of
registration be publication of the source code. I don't know how we are
going to solve this bug but we would certainly like to see a solution that
would work for Firefox. I think we're more likely to get it within W3C than
without, no ?

...Mark


> Since some years ago, software can not be based on trusth anymore, both
> from the client or the server side.
>
> > This is in contrast to the current situation where the closed software
> > comes from a third party who indeed you may not trust and about whom
> > you have no choice.
> >
> > Is this not an improvement ?
> >
> No, since in the current situation they are only software pieces that I
> have their specifications or can be able to get them by reverse
> engineering, and with them I can be able to use alternatives from sources
> that I can trust.
>
>