5 ms·

I can't wait until this gets used by malware!

mirimir 9y ago
Yes, that'll be tasty.
fixermark 9y ago
That was my first thought when I saw the spec for WebGL. "Oh boy! I'm super excited to be running arbitrary code I downloaded from web sites against an API that was never security-hardened!" Fortunately for me, my fears turned out to be overblown in that specific instance; there were a few security bugs, but they were patched with relative swiftness.
- eridius 9y ago
  I believe this specific fear is why Safari waited so long before enabling it for everyone (for a long time you had to manually turn it on in the Develop menu).
wmf 9y ago
Can you explain how malware could benefit from EME? Note that EME only applies to video.
- fixermark 9y ago
  The reasoning goes that EME is a standard that specifically allows for attaching a closed-source black-box to the browser in a standardized way. This code is not auditable by outside sources, and therefore could be a breeding ground for malware and exploits (standard open-source philosophy that "sunlight is the best disinfectant"---many eyes on open source software minimizes the opportunities for exploitable bugs to hide). We've seen codec software---even open-source codec implementations---used as an attack vector in the past. This reasoning, IMHO, ignores the fact that the user-agent still asks for consent, so the user may choose not to allow anything they can't audit. It's just the "Do you want to allow Flash to play this cool video?" story all over again.
  - danudey 9y ago
    Presumably they feel the same way about all closed-source browsers? Also, the comparison to Flash is not quite right. For example, Flash was an entire black-box, top to bottom, with a runtime, codecs, UI, a JS engine, etc., which downloaded code from the internet to run it. Web DRM, on the other hand, is a standard that allows for an encrypted video stream to be decrypted. The only differences that I can see between this and the current state of web video are that now the stream can be encrypted. Everything else is still using Javascript, HTML, CSS, HTTP, h.264/265, etc. The thing that gets me is that open-source browsers are free not to implement this extension if they're not comfortable with (or opposed to) it. The theory is that if companies start encrypting their content then open-source browsers will have to follow suit, but we already have that kind of junk; the difference is that now, with EME, we can keep 99% of the stack open standards, open-source, and auditable, rather than having to rely on Flash or Silverlight to do our decoding. EME isn't the death of the open web, it's the death of the closed web. It's the death of awful, insecure, and obsolete technologies like Flash and Silverlight by taking the one single thing they're still good for and moving it to the browser. If EME failed and no one implemented it, Netflix wouldn't just stream their content unencrypted; they'd keep using Flash or Silverlight, or maybe implement something themselves so they didn't have to.
    - gsnedders 9y ago
      > For example, Flash was an entire black-box, top to bottom, with a runtime, codecs, UI, a JS engine, etc., which downloaded code from the internet to run it. And, notably, the DRM modules can be sandboxed far more than Flash can.
  - davexunit 9y ago
    The user often does not have a choice because websites that they must use for one reason or another will require these extensions, just like some required Flash. And that's assuming that the extension even works on their system. The extensions are native code IIRC. Ever get a "sorry, your OS isn't supported!" message on a website that you really need to use to get something done? It sucks, a lot. I don't know why the W3C would want to steer themselves in such a direction, it's the antithesis of what the web was supposed to be. The web is supposed to have a well defined set of standards that anyone can implement and use to view the web. This was never true in practice because of things like Flash, but the W3C never endorsed such a thing. Now they are, and that is sad.
- deleted 9y ago
  [deleted]

Yes, that'll be tasty.

That was my first thought when I saw the spec for WebGL. "Oh boy! I'm super excited to be running arbitrary code I downloaded from web sites against an API that was never security-hardened!" Fortunately for me, my fears turned out to be overblown in that specific instance; there were a few security bugs, but they were patched with relative swiftness.

eridius 9y ago
I believe this specific fear is why Safari waited so long before enabling it for everyone (for a long time you had to manually turn it on in the Develop menu).

wmf 9y ago

Can you explain how malware could benefit from EME? Note that EME only applies to video.

fixermark 9y ago
The reasoning goes that EME is a standard that specifically allows for attaching a closed-source black-box to the browser in a standardized way. This code is not auditable by outside sources, and therefore could be a breeding ground for malware and exploits (standard open-source philosophy that "sunlight is the best disinfectant"---many eyes on open source software minimizes the opportunities for exploitable bugs to hide). We've seen codec software---even open-source codec implementations---used as an attack vector in the past. This reasoning, IMHO, ignores the fact that the user-agent still asks for consent, so the user may choose not to allow anything they can't audit. It's just the "Do you want to allow Flash to play this cool video?" story all over again.
- danudey 9y ago
  Presumably they feel the same way about all closed-source browsers? Also, the comparison to Flash is not quite right. For example, Flash was an entire black-box, top to bottom, with a runtime, codecs, UI, a JS engine, etc., which downloaded code from the internet to run it. Web DRM, on the other hand, is a standard that allows for an encrypted video stream to be decrypted. The only differences that I can see between this and the current state of web video are that now the stream can be encrypted. Everything else is still using Javascript, HTML, CSS, HTTP, h.264/265, etc. The thing that gets me is that open-source browsers are free not to implement this extension if they're not comfortable with (or opposed to) it. The theory is that if companies start encrypting their content then open-source browsers will have to follow suit, but we already have that kind of junk; the difference is that now, with EME, we can keep 99% of the stack open standards, open-source, and auditable, rather than having to rely on Flash or Silverlight to do our decoding. EME isn't the death of the open web, it's the death of the closed web. It's the death of awful, insecure, and obsolete technologies like Flash and Silverlight by taking the one single thing they're still good for and moving it to the browser. If EME failed and no one implemented it, Netflix wouldn't just stream their content unencrypted; they'd keep using Flash or Silverlight, or maybe implement something themselves so they didn't have to.
  - gsnedders 9y ago
    > For example, Flash was an entire black-box, top to bottom, with a runtime, codecs, UI, a JS engine, etc., which downloaded code from the internet to run it. And, notably, the DRM modules can be sandboxed far more than Flash can.
- davexunit 9y ago
  The user often does not have a choice because websites that they must use for one reason or another will require these extensions, just like some required Flash. And that's assuming that the extension even works on their system. The extensions are native code IIRC. Ever get a "sorry, your OS isn't supported!" message on a website that you really need to use to get something done? It sucks, a lot. I don't know why the W3C would want to steer themselves in such a direction, it's the antithesis of what the web was supposed to be. The web is supposed to have a well defined set of standards that anyone can implement and use to view the web. This was never true in practice because of things like Flash, but the W3C never endorsed such a thing. Now they are, and that is sad.
deleted 9y ago
[deleted]