3 ms·

It was Sketchfab which is basically the YouTube of 3D models, so not unreasonable to whitelist them for embeds.

• ptx 6y ago
  If embedding grants the site owner the ability to execute privileged code on my system, it is unreasonable. I wouldn't expect or want YouTube to gain full access to my system (or my user account at least) when I run a chat program.
  • gfodor 6y ago
    it doesn't, unless there's a hole in the browser. which in this case, there was.
    • ptx 6y ago
      If being on the whitelist doesn't grant any special privilege, why have a whitelist? I got the impression that it's for security, but I want my machine to be secure from YouTube as well.