1086668 - Implement blocklist handling for OpenH264 / GMP

Status: RESOLVED WONTFIX

(Toolkit :: Blocklist Implementation, task)

Description

[Georg Fritzsche [:gfritzsche]]

Bug 1009909 integrated OpenH264 with the addon manager etc., but we never added blocklist handling to this.

From what i see, the Blocklist._blocklistUpdated handles the updates and sets up the addon states as well as calling AddonManagerPrivate.updateAddonAppDisabledStates().
However, this doesn't do anything on GMP "plugin" addons right now.

We need to add a way of handling for this, implement what is missing to support this in OpenH264Provider and add explicit blocklist checks in OpenH264Provider on updates/install etc.

Comment 1

[Georg Fritzsche [:gfritzsche]]

Heads-up for mreavy.

Comment 2

[Maire Reavy [:mreavy]]

Thanks for the heads up.  How quickly can we fix this, and how far should we uplift this?

Comment 3

[Georg Fritzsche [:gfritzsche]]

While it's probably not very hard, it's not trivial to implement either. May 1-2 days for anyone with some addon manager experience (accounting for "oh my god, that addon manager" issues)?
Aurora should be good to target, but as the addon manager is involved i wouldn't feel very comfortable uplifting to beta.

Comment 4

[DJ-Leith]

This bug was opened in response to bug 1052069
"Add Openh264 Video Codec provided by Cisco Systems, Inc. to Plugincheck"
which has been RESOLVED WONTFIX.

Others are now reporting,
e.g. bug 1090013 "OpenH264 Video Codec plugin is missing in plugincheck page".

My opinions include:
A.  I am happy that this issue has been considered.
B.  I am happy with the blocklist approach.
C.  It would be *best* if the 'non appearance of / non testing of / non documentation of'
this issue i.e. WHY OpenH264 Video Codec plugin is missing in plugincheck page,
is addressed in bug 965812.


BACKGROUND

Bug 956905 comment # 148 has a
Status Update on 'the plugincheck service' as at 2014-07-16.
There is much more detail, and many references, in that bug comment.

Bug 965812, cited in bug 956905 comment # 148, is not the most urgent
blocker: bug 1020133 "Improve Adobe Acrobat plugin reporting" is more urgent.

DJ-Leith

Comment 5

[Georg Fritzsche [:gfritzsche]]

That bug may have been triggered by bug 1052069, but it is a separate issue that we do need to address.

Comment 6

[Chris Peterson [:cpeterson]]

EME CDMs are GMP plugins and will want to be blocklistable.

Comment 7

[Matthew N. [:MattN]]

Benjamin, does this block the release of EME? If so, can you coordinate with Gavin to decide whose team will implement this?

Comment 8

[Benjamin Smedberg]

I am not the product person to make the final call, but my recommendation is that this should block EME rollout (we missed this for OpenH264 but I might have blocked OpenH264 on this if we had known about it).

Comment 9

[Maire Reavy [:mreavy]]

Can we get this added to the next sprint that starts Tuesday (Feb 10)?  (Doing a needinfo to cpeterson and Marco so this can get prioritized for EME and Desktop.)

Comment 10

[Marco Mucci [:MarcoM]]

(In reply to Maire Reavy [:mreavy] (Plz needinfo me) from comment #9)
> Can we get this added to the next sprint that starts Tuesday (Feb 10)? 
> (Doing a needinfo to cpeterson and Marco so this can get prioritized for EME
> and Desktop.)

Adding it to our Backlog Generation so GMC can review to include it in IT 38.3.

Comment 11

[:Gavin Sharp [email: [e-mail]]]

It's not clear to me why we'd ever want to blocklist a GMP. Don't we have general control over their deployment such that we'd have other alternatives if a bug is discovered in them?

Comment 12

[Benjamin Smedberg]

The case in question is if we've discovered a critical problem in a GMP after it has been shipped. My understanding is that we can't un-ship a GMP using the updater manifest, and so we'd be using the blocklist to disable old versions.

Also to deal with the case where the user has disabled automatic GMP update.

Comment 13

[Chris Peterson [:cpeterson]]

Anthony or Javaun: do we need CDM blocklist support for the Adobe EME MVP?

Comment 14

[Anthony Jones (:ajones, :kentuckyfriedtakahe, :k17e)]

Disabling updates isn't really an option for the CDM. A breech is dealt with through the keyservers. This may be useful in the future but it's not MVP.

Comment 15

[Chris Peterson [:cpeterson]]

Disabling a CDM on the keyserver would address DRM compromises but it wouldn't prevent client exploits. Considering that we've already been shipping OpenH264 without this GMP blocklist, we probably don't need to block EME MVP. Our sandbox should help, too.

Comment 16

[Rob Wu [:robwu]]

Moving over to Blocklist implementation and resetting priority/severity for re-triage.

Plugin support is being removed in bug 1675349. Currently the implementation of the plugin blocklist is still there, but without any consumers the code is going to rot.

Comment 17

[Rob Wu [:robwu]]

FYI https://phabricator.services.mozilla.com/D95919#3124815 :

If in 6 years we've not found a reason to support GMP plugin blocklisting then I think removing all of this is fine - if we want it we can work out how we do it then.

Plugin blocklist code is going to be removed at https://phabricator.services.mozilla.com/D107148?id=407995#inline-599174

I suppose that we can close this issue?