Xfinity Stream on Linux: A Tale of Widevine, ChromeOS, and a patched Glibc (opens in new tab)

>Another option is to cablecut. If Comcast don't want you using their service, then don't.

Comcast always tries to give you free devices, cable boxes, streaming sticks etc., even when you have just internet service from them. Aside from all these issues, there's another downside to "free cable", which is that they tack on various fees (HD fee, technology fee, etc.) even if the base price of internet + cable may seem the same as just internet. So, never get get cable.

It will be years before I have the same experience watching sports on a streaming service as on digital cable.

And for no technical reason, it's just monopolized broadcast rights to the games I want to watch.

hilariously just so you know YouTube TV also uses this exact DRM technology if you were to try to screen record or screen grab while watching in Chrome

Comcast is literally a monopoly in the majority of the western US. You cannot cablecut if you need internet access.

And generally costs more per month than Xfinity!

Maybe it's because my system has wine-devel, but running Chrome or Firefox under Wine has always been really buggy for me.

I had that working for the last year or so, for the exact same reason. But for a few weeks now my wine'd Chrome can no longer access any page, as if it can't access the network or something. Tried reinstalling it, but that didn't help either. Any ideas?

Bah, this is genius! Any obvious gotchas? Did you try it with Netflix?

Google updates the Widevine CDM regularly and has an aggressive deprecation schedule. I imagine those keys have long since been replaced as a result of this. Each piece of content is encrypted with a unique key and the CDM is only used for key exchange. The leaked keys would be useless for decrypting any stored content.

Widevine L3 gets broken fairly often, I'd assume that's what xfinity stream on ChromeOS is using.

To my understanding, Widevine has two modes: L1 and L3. L3 is software protection where the browser protects against most simple reverse-engineering, but sends an unencrypted video stream to the OS' window compositor, so you can still screen record the content if you'd like. L1, on the other hand, requires a full chain of trust, meaning the encrypted video stream is sent to your GPU unit (or TV SOC), and the GPU has safeguards to prevent the OS from being able to capture that part of the screen, and most importantly has a HDCP handshake with the output device.

When a service is selecting which streams your client is granted a license to, if you claim L1 protection, the license request includes a signature from the GPU/chip doing the decryption, so the service will know whether your device only supports L3 software protection, or has a full chain of trust for the content and thus can protects against things like the user screen recording video content. Chances are the contracts rightsholders have with Netflix et al. require L1 for HD or UHD streams, and only allow L3 420p streaming (note that Netflix Originals seem to stream at 720p on L3, at least from what I've heard).

> That said, it seems odd that silliness like this still exists.

It's only going to get worse. I don't think it's gonna take too long for corporations and governments to mandate locked down computers for everyone. Soon all software will require attestation against "tampering". Copyright industry wants this because "piracy". Banks wants this because "fraud". Messaging services want this because "terms of service". Maybe one day even ISPs will refuse to allow user controlled computers on their networks. Who knows what they could do, right? They might be a terrorist or pedophile running Tor and encrypting everything.

I don't pirate games anymore but I still routinely pirate TV content because dealing with this nonsense is just not worth the time and effort. I'm willing to buy media. I'm not willing to be told when and where I can watch it. I buy my movies and TV on physical media, then pirate a copy to actually watch on my various devices. Far more convenient for me than bending over backwards for DRM schemes.

My Steam games, meanwhile, largely all work on Windows and Linux with no silly barriers stopping me. Just one reasonable one: login to Steam once in a while.

It's made game piracy the hassle by comparison, which is the opposite direction than that taken by current media streaming. Gabe was right when he said piracy is caused by service issues.

I have Firefox configured to not play DRM content unless explicitly allowed, which means it shows a permission infobar each time a site tries to use it.

The number of sites that do it without having a good reason to, likely for fingerprinting purposes, are astonishing.

What non-DRM video have you bought, if any?

From my understanding, neither.

It's the same code (presumably) but Chrome OS's version was compiled with metadata that said it was running on Chrome OS and Linux's version was compiled with metadata that said it was running on Linux. And that metadata is later embedded into the license request which Xfinity's servers check.

Of course, that's just my assumption from what I understand. I can't verify anything due to how obfuscated Widevine is. But due to how long-lived this problem has been, the two Widevine versions having the exact same version number (4.10.2557.0), and that everything else Widevine-wise works, I'm inclined to believe that this is intentional.

Especially odd given the entire point of Widevine is to set a content protection minimum that works cross-platform, which his machine obviously meets given it's playing video (while I had suspected xFinity would require Widevine L1/a full hardware chain for any playback, it looks like they offer a lower resolution like 720p(?) for L3 devices).