News and announcements
Pipelight 0.2.4
Written for Pipelight by Michael Müller on 2014-01-19
******
There was a regression in 0.2.4 which broke Pipelight with some browsers like Firefox, but this is now fixed in version 0.2.4.2. Please update your packages if you encounter such a problem.
******
The Pipelight version 0.2.4 introduces some speed improvements which especially target Silverlight on slower systems that were not able to reach the full frame rate. By modifying the wine patches and several changes to make Pipelight work a bit more asynchronously this effectively increases the performance. Other changes introduced support for the Widevine plugin or made Pipelight compatible with even more browsers.
Before we continue with list of all changes, I want to make a small announcement: We are presenting a talk about Pipelight in the Wine developer room at the FOSDEM 2014 (in Brussel) in ~2 weeks. If you are interested in the backgrounds of Pipelight or just want to meet us in person, feel free to join our talk. Entrance is free and more information are available at https:/
--[Widevine]--
One of the changes for Pipelight 0.2.4 introduced support for the Widevine plugin which is a bit special compared to other supported plugins. The plugin itself does not work standalone and instead just offers DRM capabilities to the normal Flash plugin. While the Widevine plugin itself does all DRM related stuff like key exchange and decryption, the rendering is still done by the normal Flash plugin. Pipelight allows you to combine Widevine with either Windows, Linux or Pepper Flash. It is therefore possible to render the video with a native linux Flash executable while only the decryption part is done via Wine which results in a very good playback performance. To prevent confusion: there also exists a Widevine DRM module for Chrome which does not need Flash, but it's not largely used by websites as it's only compatible with a single browser.
To use Widevine, simply execute:
sudo pipelight-plugin --enable widevine
--[Linux windowless mode]--
We have added support for offscreen rendering in Pipelight which is required by some QT based browsers or browsers which do not support overlaying of normal windows like the OpenGL based Steam browser. The new mode still suffers from some input related problems and must be enabled manually in the config or via an environmental variable, but can actually fix some Flash mouse input problems when Flash is rendered above html controls. Anyway, it is not really recommend to use this mode if it is not necessary as all rendering is done through the browser and it is therefore not possible for a plugin to use hardware acceleration on it's own (some plugins like Unity3D will not work at all). To enable this mode either set PIPELIGHT_
--[AMD GPU Acceleration]--
The Silverlight plugin still has some problems on AMD graphics card and the GPU acceleration is therefore disabled by default if Pipelight detects neither a NVIDIA nor Intel graphic card. We were now able to track down the problem to the drawing call ordering which is different between Windows and Wine's D3D layer. Stefan Dösinger is working for Codeweavers on a patchset to implement the same behaviour as on Windows, which also solves this problem. Nevertheless, applying around 200 patches on Wine makes maintaining much more complicated and we are therefore going to wait till they landed which hopefully shouldn't take too long. In the meantime we added the value 2 to the PIPELIGHT_
PIPELIGHT_
--[Plugin licenses]--
In all previous Pipelight versions the installation of a plugin was silent and the license of a plugin was therefore automatically accepted. While it should be clear that you need to accept the Silverlight license when you want to use this plugin, it may not be so obvious that some plugins also required additional files from Microsoft. These files are needed to workaround bugs in Wine and are downloaded automatically during the plugin installation. In order to make this whole process a bit more transparent, you will now be asked to accept these licenses when you enable a plugin with pipelight-plugin. Instead of showing all the installation dialogs Pipelight will give you a plugin dependent list of all licenses which you need to accept. We also made the Wininet.dll replacement optional as it is only required by some Silverlight sites. If you suddenly see some old fashioned windows dialogs which ask you for your username and password you most probably hit such a website. To enable the wininet.dll replacement you need to create a file and therefore accept the according license (as shown during enabling the plugin):
touch ~/.config/
Make sure to read the license and remember to repeat this step for every user on your system who wants to use the original wininet.dll.
--[Misc]--
* The default config path changed from /usr/share/
(i.e. they are now in a separate subfolder)
* The Adobe Reader plugin is now supported an an experimental plugin, but the Adobe Reader sandbox is disabled by Pipelight as it does not work with Wine. Use it only at your own risk!
-------
If you want to see all the changes in detail please take a look at the the full changelog:
https:/
Updated .
Pipelight 0.2.3 (+0.2.2)
Written for Pipelight by Michael Müller on 2013-12-16
The Pipelight version 0.2.3 introduces new security concepts for using Windows plugins on Linux - this includes EXPERIMENTAL sandbox support and an easier way to update to the current version of plugins. Since the number of supported plugins and Pipelight users is increasing the topic security got much more important and we started to develop new mechanisms to lower the surface for attacks. We will of course still provide regular pipelight updates, especially for security critical stuff (0.2.2 for example was only a security update containing a new version for flash and some minor bug fixes), but we wanted to improve this even more. Before we take a closer look at these new features I want to inform you about some changes which are not directly related to this Pipelight version but important nevertheless:
--[Pipelight PPA]--
The most common way to install Pipelight on Ubuntu is by using our PPA or to be more precise to use two PPAs since the Wine build of Erich E. Hoover is required by Pipelight. Since we are working together with Erich E. Hoover the division in two PPAs was more some kind of artificial restriction caused by the PPA system, but did not really represent the way we shared patches and code. Recently we decided to merge our work into a single new PPA so that is no longer needed to add two PPAs and moreover allows us to update packages more easily. The disadvantage of this change is that Launchpad does not allow us to redirect users from an old PPA to a new one and this step requires manual user intervention. The required instructions in order to switch to the new PPA are:
sudo add-apt-repository --remove ppa:mqchael/
sudo add-apt-repository --remove ppa:ehoover/
sudo add-apt-repository ppa:pipelight/
Since not all users will read this notice, we will keeping pushing new updates also into the old PPAs but may stop this in the future. It is therefore recommend to execute the commands above.
--[Pulseaudio]--
One common problem while using Pulseaudio is that the provided ALSA emulation layer contains some bugs which randomly break the sound output and cause fast-forward playback in Flash or Silverlight. One way to work around this problem is to avoid the ALSA emulation and directly communicate with the Pulseaudio server, which is not directly supported by the original Wine version. Nevertheless, Canonical wrote some patches to implement this missing feature and also applied them to the regular Ubuntu version of Wine. We decided to include them also in our build since it is possible to switch between both of them and it may fix the sound problem in some cases. If you experience new issues since the update, take a look at https:/
--[Smaller / Experimental Plugins]
The number of supported plugins increases and also creates a new problem which is caused by the fact that most browsers try to avoid loading the same plugin multiple times. They do not load a plugin twice if the inode and device of the plugin file is the same as it would be the case if you have multiple symlinks or hardlinks to the same file. This has the disadvantage that we need to copy our libpipelight plugin file for every supported plugin and therefore waste much more space than theoretically would be necessary. Since we need to replace these files on every update, we need to store the copies at a central place in the filesystem and it therefore requires root rights for this step. Until recently we automatically created these libraries for all supported plugins.
This solution is not longer practical as we also started to implement smaller and experimental plugins and therefore split them into two categories. The first category contains the most commonly used plugins like Flash or Silverlight while the second one contains only plugins which are not used by a larger part of the community or simply do not work very well yet. The plugins inside the first category will still behave like in old Pipelight versions and you can enable them by using "pipelight-plugin --enable" while plugins from the second category will need an extra call of "pipelight-plugin --unlock-plugin NAME". The "--unlock-plugin" / "--lock-plugin" commands will create / remove these copies and therefore the disk usage by pipelight will more likely fit your number of used plugins. If you try to enable a locked plugin, you will also get an error which shows how to unlock the plugin. The current supported plugins by category are:
Normal plugins:
- Silverlight
- Flash
- Unity3D
Exerperimental:
- Schockwave (was put into this category as the number of users is quite small)
- Grandstream (Camera surveillance plugin, does currently work only in Firefox, only useful if you have such a camera!)
- Foxit PDF (highly experimental, does not work most of the times)
--[Plugin Updates]--
Our current solution for providing plugin updates to our end users is to issue a new version of Pipelight as the normal plugin updaters do not properly work inside of Wine. While normal plugin updates will be included in the next regular release, we try to push out new versions within a timely fashion if the update is security related. Nevertheless it takes some time till an update reaches all users since we can not provide packages for every distribution and it therefore depends on the corresponding package maintainers.
The plugin versions are mainly controlled by the dependency-
--[EXPERIMENTAL Sandbox]--
*** WARNING: Even though we announce the sandbox here, it still has to be considered HIGHLY EXPERIMENTAL. This part addresses only experienced developers! ***
Last but not least the main change inside this release is the support for our new sandbox called 'pipelight-sandbox' (I know, very creative) which should protect you from any harmful action done by a plugin. The NPAPI itself does not support any sandboxing and it is therefore not possible to restrict the permission of a plugin. To get around this restriction we decided to put the whole wine process with the plugin into a sandbox to protect our users against Windows malware or other infections. Our aim was to use a sandbox which does not have any big impact on the speed and perfectly fits our needs. We started to write our own implementation, which is based on namespaces (similar to lxc containers) which has mostly two advantages: the namespaces do not have any impact on the performance compared to for example ptracing a process and instead of denying access to specific functions we need to grant them.
The sandbox will protect you from any permanent changes by marking your filesystem as read-only (except the wine directory) and completely separating all processes inside the sandbox from your regular ones. The processes inside the sandbox will not be able to see the processes outside, since they are run in a different PID namespace, and all kind of communication through sockets or shared memory is blocked. The only exceptions are the pulseaudio socket and the Xorg socket so that the plugins will be able to play sound and display video data. Both sockets are not directly available but will be proxied through our sandbox so that we can filter out file handles or other possible harmful messages. All these exceptions are not hard coded into the sandbox but are controlled via command line parameters. To protect not only your computer but also other machines on the network all local IP addresses are blocked except the Port 53 TCP/UDP to allow DNS resolving with local dns caches.
As mentioned in the introduction our current implementation is still HIGHLY EXPERIMENTAL since changing the namespaces requires root rights and the pipelight-sandbox must be a SUID binary. We would like to get some feedback from EXPERIENCED PROGRAMMERS before we are going to release the first stable version and therefore provide the sandbox inside a separate PPA. The only disadvantage caused by the usage of namespaces is that it requires a recent kernel (>= 3.8) to work properly and you will need Ubuntu 13.04 / 13.10 if you want to use the standard Ubuntu kernel. If you have a suitable kernel, you can test the sandbox with Pipelight by executing the following steps:
sudo add-apt-repository ppa:pipelight/
sudo apt-get install pipelight-sandbox
sudo dpkg-reconfigure pipelight-multi
You will need to answer the question whether you want to enable the sandbox for Pipelight with yes otherwise Pipelight won't use it. The reason behind this question is that the sandbox also works with other linux processes and is not only limited to wine. Packages for other distributions may follow when the sandbox reaches a stable state, but it is also very easily to compile it yourself. The only needed build dependencies are the development files of iptables.
The sandbox is still under development and not all features like graphic acceleration may work with all drivers. One small issue we found during our tests is that not all distributions load the required iptables modules during the start of the system. The iptables rules are only active inside another network namespace and therefore they won't affect your normal system, but the necessary modules must be loaded. If you see an error, when you start your browser from a terminal, which is telling you that iptables is not found, simply execute "sudo iptables -t mangle -L". This command will simply list the rules of the mangle table and is just used as a dummy here to force iptables to load the missing kernel modules.
If you are interested in playing around with our sandbox or want to hack it, feel free to take a look at "pipelight-sandbox --help" to get more information about the available options or take a look at the wine-sbox script used by Pipelight. The command "pipelight-sandbox bash" will for example give you a sandboxed bash instance where only /tmp write access is allowed.
-------
If you want to see all the changes in detail please take a look at the the full changelog:
https:/
Pipelight 0.2.1
Written for Pipelight by Michael Müller on 2013-10-31
We are happy to announce Pipelight 0.2.1 which brings support for new plugins and improves the usabillity of the existing ones. The new plugins added in this release are the Shockwave Player (not to be confused with Flash) and the Unity Webplayer. They still need to be considered as experimental but we decided to include them anyway since they already work flawless with a lot of games. A more extensive summary of the changes follows.
--[Shockwave Player]--
This release brings support for Shockwave which works quiet good with the content we tested, but there are still some games which have problems with mouse or keyboard input. The installation of the plugin is done the same way as the other plugins, simply execute
sudo pipelight-plugin --enable shockwave
and Shockwave should get installed on the next start of your browser. The first time you start the plugin you should do a right click on the plugin and select OpenGL as renderer since the DirectX renderer does not work. Moreover it is also recommended to open the settings and disable the backwards compatibility which fixes the input problems for the most games. These options are set by Pipelight after the plugin is installed, but for some reason Shockwave sometimes resets the settings on the first start.
More information and a link to a test game is available at http://
--[Unity Webplayer]--
The Unity player is still a bit experimental since Wine lacks some features which are needed by Unity and we use some hackfixes to get around these issues. Anyway almost all tested games (for example all demos on the unity website) worked without issues and we only found one game which didn't work at all. The installation can be done via
sudo pipelight-plugin --enable unity3d
and depending on the site you want to use, you will also need to use a user agent switcher. Surprisingly the Unity Website works only if you select Safari and Mac OS X as User agent. They most probably also check the navigator.platform field which is not set by most of the user agent switchers.
Some games which require large downloads at the initialization sometimes fail to download all the data at once and you will see an error message. Although it is annoying, the problem can be easily solved by reloading the page and Unity will continue to download the data at the position where it stopped. More information about Unity is available at http://
--[Flash Click-Through]--
We fixed an annoying bug which sometimes happened when you have multiple tabs with Flash content opened and the Flash windows were at the same position. Depending on the order in which the windows were created it was possible that you controlled an invisible flash application in the background instead of the visible one. This problem was related to the fact that Wine didn't notice that the browser made the window invisible on a tab change. This is now fixed and shouldn't happen any more.
--[Keyboard Input]--
Plugins which used the windowless mode (a NPAPI term) had problems with keyboard input and it was not possible to enter characters. This problem was only experienced by a small amount of users since Silverlight normally doesn't use this mode, but got more attention with Flash which uses windowless by default. We were able to find the problem in the event handling and the bug should be fixed now.
--[Static linking]--
Pipelight up to version 0.2.0 linked the windows part dynamically against the mingw runtime which had the disadvantage that we had a dependency on the full mingw cross compiler since the four needed libraries were not available as single package. We switched now to static linking so that this dependency is no longer needed and it should be possible to get some disk space back by executing apt-get autoremove after the update.
--[Flash hardware acceleration / 3D]--
This release will automatically switch your pipelight flash settings to use hardware rendering for Stage 3D content. This still causes some problems with games as the DirectX -> OpenGL layer of Wine introduces flickering, but these problems don't occur for videos. Since the most flash games which use Stage 3D are unusable slow in software rendering, it is unlikely that this change will have disadvantages for the most users. You can verify that it works by opening a youtube video in fullscreen and taking a look at the statistics, which should show accelerated video rendering. GPU decoding is still not supported since Wine doesn't support DXVA.
--[Popup menu / Embed / Stay in fullscreen]--
If you make a right click on a plugin and it is not in fullscreen mode you will notice that we extended the menu entries of the original plugin with some Pipelight related functions. First of all you should see a new entry which shows the version of Pipelight you are using and will take you to the launchpad site when you click on it. The next two options allow you to temporarily change some settings of Pipelight.
The embed entry defines whether the plugin should be shown in external window. This is useful for Silverlight applications which either show the video at a fixed size or fullscreen mode since the external window can be resized. Our intentional idea was to switch this mode on the fly, but it causes a lot of problems with Wine and the options therefore only affects the next start of a plugin and will be reset when the browser starts a new plugin process. Reloading the page normally doesn't spawn a new process and should behave as expected.
The next option is especially interesting for people with multiple screens since Silverlight and Flash leave the fullscreen mode when they loose focus and you can now prevent this behavior by enabling the stay in fullscreen option. In contrary to Silverlights "stay in fullscreen" implementation this does not only work with websites which request it, but with all of them.
--[NTLM Authentication]--
This release no longer relies on the wininet version provided by Wine but instead we now use a version provided by the internet explorer. The reason for this is that the Wine implementation has several problems with NTLM HTTP authentication scheme and breaks Silverlight applications relying on it. The handshake is still done by Wine and you need to have ntlm_auth installed to get it working (this is provided by the winbind package on Ubuntu) but the http connection handling is now done correctly. One Silverlight application which benefits from this change is the RavenDB client.
-------
If you want to see a list with all changes take a look at the the full changelog:
https:/
Updated .
Pipelight 0.2.0
Written for Pipelight by Michael Müller on 2013-10-14
We jumped from version 0.1-4 to 0.2.0 (the version scheme changed a bit) since this release includes some fundamental changes in the way Pipelight works. The most obvious improvement is multi-plugin support, so that Pipelight can not only handle Silverlight but also other windows plugins like for example Flash (and some more in the near future). The following text should give you a short summary about all changes:
--[Multi-plugin support]--
The Pipelight package is now only a meta package which installs the new pipelight-multi package and enables Silverlight. This way was chosen to stay compatible with old installations, but has the disadvantage that using the new pipelight-multi commands while having the pipelight package installed may cause weird behavior in some cases. It is therefore recommended to use only the multi package if you want to use more than one plugin. An upgrade can easily be done by executing:
sudo apt-get remove pipelight
sudo apt-get update
sudo apt-get install pipelight-multi
sudo pipelight-plugin --enable silverlight
The currently supported plugins are Silverlight and Flash which both seem to work very well, but we are also working on other plugins like the Unity 3D webplayer and Widevine.
We also implemented the possibility to enable plugins on a per user basis instead of having to do this system wide. Depending on whether the pipelight-plugin script is executed with root rights or not the plugin is either enabled for all users or only the current user.
For example this commands enables flash for all users
sudo pipelight-plugins --enable flash
while the following command only enables it only for the user executing it:
pipelight-plugins --enable flash
More information on how to enable / disable plugins or how you can tell your Browser to use the windows flash version, take a look at: https:/
--[Easier Silverlight version switching]--
You can now switch the Silverlight version with just one command and it's no longer necessary to edit configuration files for this. Pipelight handles the Silverlight versions as different plugins and you can for example switch from the current Silverlight version to 5.0 by executing:
sudo pipelight-plugins --disable silverlight --enable silverlight5.0
The "silverlight" plugin is an alias to the latest version which is currently silverlight5.1. You can also enable multiple versions of the same plugin, but this shouldn't make much sense in the most cases.
--[Installation of plugins]--
The installation process of the required plugins files is now more visible to the user. You will see dialogs during the installation which will inform you about the current process so that it is more clear that your browser is not frozen, but paused because the installation is still in progress. This is especially useful if you are using multiple plugins at the same time as the installation process can take several minutes. The only disadvantage of the new installation method is that if you upgrade from an older version without multi-plugin support a reinstallation of Silverlight will be triggered.
Since we also changed the configuration file names, all existing installations will be upgraded to Silverlight 5.1 irrespective of the fact that the old configuration may have a different Silverlight version set. Unfortunately you will have to redo the corresponding changes again if you experience problems (take a look at the updated FAQ entries).
--[Other changes]--
We also did a lot of code clean up/rewrite and moreover fixed some small bugs.
-------
If you want to see all the changes in detail please take a look at the the full changelog:
https:/
Pipelight 0.1-4
Written for Pipelight by Michael Müller on 2013-09-16
We just released Pipelight v0.1-4 which mostly introduces experimental features and bug fixes.
The following text gives a short summary about the most important changes:
--[Experimental Flash support]--
It is now possible to use the Windows version of Flash with Pipelight, which is a mandatory step to get Widevine DRM working in future releases. You currently need to decide whether you want to use Flash or Silverlight since it's not yet possible to use both at the same time with Pipelight, but this will change in future. For this reason the support is only experimental and there are no ready to use installation packages, however here is a short guide how to switch to Flash:
1. Install Pipelight
2. Start your browser and test if Silverlight works (this will create the Wineprefix and other stuff that is required) and close it again
3. Execute:
wget http://
WINEARCH=win32 WINEPREFIX=
cp /usr/share/
sed -i 's|^[^#
sed -i 's|^[^#
4. Start your browser and enjoy the Windows version of Flash (you may have to disable other Flash plugins in some cases, so that your browser selects this one).
--[Experimental Sandbox support]--
We implemented the possibility to define a sandbox program which is currently not very useful since the corresponding sandbox program is still work in progress. It will be available as a separate program/package and should protect you against all possible attacks and viruses coming through the used browser plugins. More information will follow in a separate announcement.
--[Bug fixes]--
While working on the Flash support we discovered a bug in our handle management which also affects Silverlight and may prevent some Silverlight applications from shutting down clearly. If you had the problem that you got a crash warning on closing the tab, you should check if this error is gone with the current version of Pipelight.
-------
If you want to see all the changes in detail please take a look at the the full changelog:
https:/
