6 ms·

WebAssembly doesn't grant any extra permissions into the inside of the browser sandbox. Audio and canvas HTML elements already exist and don't have any innate c

WebAssembly doesn't grant any extra permissions into the inside of the browser sandbox. Audio and canvas HTML elements already exist and don't have any innate connection to WebAssembly. (If you ignore performance, WebAssembly could be entirely polyfilled into old browsers that didn't support it through a Javascript interpreter.)

vbezhenar 6y ago
It's not about permissions. It's about decoding video using WebAssembly and rendering it on canvas. Browser can't prevent it. Now I'm not sure that it wasn't possible before WebAssembly... Decoding some tiny video should not be that resource-intensive. Also you could just utilize GIF.
- a1369209993 6y ago
  More to the point, it's about decoding documents using WebAssembly and rendering that on canvas, thus circumventing browser-based discrimination between legitimate and malicious content.
- eis 6y ago
  It is about permissions. You can autoplay video just fine with HTML5. But you can't do it with sound. And how would your WebAssembly decoded video play sound? Right, using the exact same HTML5 media elements. WebAssembly doesn't allow you to somehow do different things in the page. It only allows some computations but to actually have any output it has to resort to the same APIs that your normal JS uses.
  - vbezhenar 6y ago
    If you can autoplay html video without sound right now, then you're right, I thought that autoplay was forbidden for all videos.
    - magicalhippo 6y ago
      That's what I told Firefox, but for some reason video autoplays just fine all the time so...
      - RedComet 6y ago
        Same, is there a fix for this?
        padenot 6y ago
        Firefox media developer here. It's a bit hard to understand what the problem is, sorry. You can block video and sound auto-play altogether, or just audio, or none, in `about:preferences#privacy`, and choose or check exceptions you've granted, but if I read the grand-parent comment correctly, an appropriate setting has already been put in place. Additionally, if the website really wants to play audio against a visitor's will, it can try to hijack clicks and touch events. There are some plans to tighten this, the spec was designed to allow implementing various policies. It should also be possible to write a content blocker for this as a Web Extension (maybe it already exists). Does this happen on all websites? On some websites, that you could possibly share with us, so we can have a look and understand what's up ? Can anybody that is not satisfied about this open a ticket at https://mzl.la/363s8KN https://mzl.la/363s8KN, and put in `:padenot` in the box `Request information from` (log in with github or a bugzilla account) with some info about the websites ? An alternative would be to send me an email, username at mozilla.com.
        magicalhippo 6y ago
        Thanks, I'll keep this in mind and report when I get it next time. So far uBlock Origin seems to be pretty good at keeping the most annoying videos at bay, but sometimes they do slip through.
        rbg246 6y ago
        I also noticed it today on a website that video was autoplaying and was shocked by it as Firefox has stopped that for some time. I'll note where it happens again.
hackcasual 6y ago
Yep, people seem to have a hard time understanding that WebAssembly doesn't add any new functionality, it just makes what JS can already do more performant (for cases that benefit from it). WebAssembly by itself is actually running inside a more restrictive sandbox even.

vbezhenar 6y ago

It's not about permissions. It's about decoding video using WebAssembly and rendering it on canvas. Browser can't prevent it. Now I'm not sure that it wasn't possible before WebAssembly... Decoding some tiny video should not be that resource-intensive. Also you could just utilize GIF.

a1369209993 6y ago
More to the point, it's about decoding documents using WebAssembly and rendering that on canvas, thus circumventing browser-based discrimination between legitimate and malicious content.
eis 6y ago
It is about permissions. You can autoplay video just fine with HTML5. But you can't do it with sound. And how would your WebAssembly decoded video play sound? Right, using the exact same HTML5 media elements. WebAssembly doesn't allow you to somehow do different things in the page. It only allows some computations but to actually have any output it has to resort to the same APIs that your normal JS uses.
- vbezhenar 6y ago
  If you can autoplay html video without sound right now, then you're right, I thought that autoplay was forbidden for all videos.
  - magicalhippo 6y ago
    That's what I told Firefox, but for some reason video autoplays just fine all the time so...
    - RedComet 6y ago
      Same, is there a fix for this?
      - padenot 6y ago
        Firefox media developer here. It's a bit hard to understand what the problem is, sorry. You can block video and sound auto-play altogether, or just audio, or none, in `about:preferences#privacy`, and choose or check exceptions you've granted, but if I read the grand-parent comment correctly, an appropriate setting has already been put in place. Additionally, if the website really wants to play audio against a visitor's will, it can try to hijack clicks and touch events. There are some plans to tighten this, the spec was designed to allow implementing various policies. It should also be possible to write a content blocker for this as a Web Extension (maybe it already exists). Does this happen on all websites? On some websites, that you could possibly share with us, so we can have a look and understand what's up ? Can anybody that is not satisfied about this open a ticket at https://mzl.la/363s8KN https://mzl.la/363s8KN, and put in `:padenot` in the box `Request information from` (log in with github or a bugzilla account) with some info about the websites ? An alternative would be to send me an email, username at mozilla.com.
        magicalhippo 6y ago
        Thanks, I'll keep this in mind and report when I get it next time. So far uBlock Origin seems to be pretty good at keeping the most annoying videos at bay, but sometimes they do slip through.
        rbg246 6y ago
        I also noticed it today on a website that video was autoplaying and was shocked by it as Firefox has stopped that for some time. I'll note where it happens again.

hackcasual 6y ago

Yep, people seem to have a hard time understanding that WebAssembly doesn't add any new functionality, it just makes what JS can already do more performant (for cases that benefit from it). WebAssembly by itself is actually running inside a more restrictive sandbox even.