6 ms·

> Privacy considerations Rendered <model> data is not exposed to / extractable by the page in this proposal, so no tainting is required. We do expect this woul

> Privacy considerations Rendered <model> data is not exposed to / extractable by the page in this proposal, so no tainting is required. We do expect this would require extensions to Fetch (a new destination type), Content Security Policy (a new policy directive), and likely a few others. I do buy 3d model data occasionally (hobby, not for professional uses). I think most stores obfustcate the data somehow although I never took a look at it in detail. If you wanted, you probably could easily extract the model from the preview. I still think this is a very bad proposal. Why compare something with an image and then disallow it to be treated like other ressources? This is typically bad corporate influence on the web. I think we should go the other way. Remove DRM components from browsers again. Netflix not available anymore? They will either adapt or not be available. Their loss would probably be more significant.

gruez 5y ago
>I still think this is a very bad proposal. Why compare something with an image and then disallow it to be treated like other ressources? This is typically bad corporate influence on the web. Because webgl fingerprinting. Also, I'm not sure why you think not being able to extract the data using javascript is "bad corporate influence on the web" or" DRM". you can still do whatever you want. The models are freely available for you just not the page.
- BiteCode_dev 5y ago
  You, the dev. Not you the client, hence the user. It's closed software by design, and we all have seen where it leads to.
  - gruez 5y ago
    >You, the dev. As per the parent comment, it's not exposed to the javascript running on the page, which is arguably the "dev" in this case. >Not you the client, hence the user. I fail to see how it being exposed to the javascript running on the page or not makes a meaningful difference to the user. Are we expecting the average user to interact with the page via the developer console or something? >and we all have seen where it leads to. The proposal doesn't have any DRM element at all. At worse you can just inspect network traffic to download the model file to disk and open it in whatever app you want.
    - BiteCode_dev 5y ago
      > I fail to see how it being exposed to the javascript running on the page or not makes a meaningful difference to the user. Are we expecting the average user to interact with the page via the developer console or something? No, but I'm expecting the average user to be able to enjoy an open ecosystem. Such as bookmarklet, addons, client side widgets, electron apps, WASM plugins, and all the wonderful things we can't yet think of now. Instead, we will have one more walled garden. And just like that, piece by piece, the next step in the IT revolution will be more and more close. Because that's the plan, that's what they want. Something the computer runs, but has no control over.
      - gruez 5y ago
        >No, but I'm expecting the average user to be able to enjoy an open ecosystem. Such as bookmarklet, addons, client side widgets, electron apps, WASM plugins, and all the wonderful things we can't yet think of now. But there's still webgl and <canvas>. I'm failing to see what type of use cases we're missing out on here, because javascript access is missing.
    - deleted 5y ago
      [deleted]
  - imwillofficial 5y ago
    Closed software? You mean being used by every person on earth every day of their lives?
    - BiteCode_dev 5y ago
      People also consume refined sugar, alcohol, saturated fat and cigarettes regularly. Just because something is common doesn't mean it's good for you. I'm not against closed software mind you, I'm using some myself, but the web as a platform has reached this amazing stage because it's been built on openness. And now the very same companies that became rich thanks to this openness want to close it to get all the benefits for themself.
snet0 5y ago
My understanding is basically that DRM is the technology that permits the existence of Netflix and similar. Perhaps I just lack a strength of principle, but I don't see why you'd remove one of the most-enjoyed aspects of the internet for the sake of uh... some kind of privacy-adjacent something?
- tehbeard 5y ago
  We got to an ok compromise of video tags and native browser support, with DRM extension for corporate needs/reqs... Is it the best? No. Could it worse, definitely. But without it youd need a Netflix app on your PC... And what safeguards does that have from hoovering my pc usage up for sale or marketing? Atleast Netflix only gets MY Netflix consumption for their metrics and ML, and isn't cross referencing the games I play or other things I'm doing at the same time.
  - snet0 5y ago
    In addition to the privacy concerns with native applications, they're almost always insecure. One thing that is nice about modern browsers is that (despite Safari's leisurely update cycle) they are actually relatively secure, as far as software goes. Threats to the average user of Chrome are things like phishing, rather than RCE, and tab isolation keeps things from escalating out of control. Contrast that to the now ubiquitous conferencing software solutions, and it seems like every day there's some zero-day RCE vulnerability or other spooky exploit. If we needed to install and run a dozen different closed-source executables from BigCorp et al., I predict that we'd very soon go back to security dark-ages.
- frostburg 5y ago
  Isn't everything on Netflix ripped as soon as it is available? What is the DRM doing? Compliance?
- dangerface 5y ago
  Netflix make money from their subscription service not DRM. I can easily torrent anything I watch on netflix but I watch it on netflix because its easier. Thats why I pay for netflix its not because their DRM prevents me from pirating anything.
Telemakhos 5y ago
As I understand it, this is not so much about DRM as it is about privacy. The new model tag allows the browser to sandbox the display of a 3d object without reporting information back to the web page/server. This way, the browser can use camera data to track the user eye position relative to the device for parallax or to show what is behind the device to accomplish the effect known as "augmented reality." In other words, Apple wants developers to be able to deploy augmented reality experiences on the web without giving them access to the user's camera, which is a privacy issue.
- dheera 5y ago
  Hmmm I wonder if this would open more side channel attacks to extract information about the user without even going through a permissions dialog.

gruez 5y ago

>I still think this is a very bad proposal. Why compare something with an image and then disallow it to be treated like other ressources? This is typically bad corporate influence on the web. Because webgl fingerprinting. Also, I'm not sure why you think not being able to extract the data using javascript is "bad corporate influence on the web" or" DRM". you can still do whatever you want. The models are freely available for you just not the page.

BiteCode_dev 5y ago
You, the dev. Not you the client, hence the user. It's closed software by design, and we all have seen where it leads to.
- gruez 5y ago
  >You, the dev. As per the parent comment, it's not exposed to the javascript running on the page, which is arguably the "dev" in this case. >Not you the client, hence the user. I fail to see how it being exposed to the javascript running on the page or not makes a meaningful difference to the user. Are we expecting the average user to interact with the page via the developer console or something? >and we all have seen where it leads to. The proposal doesn't have any DRM element at all. At worse you can just inspect network traffic to download the model file to disk and open it in whatever app you want.
  - BiteCode_dev 5y ago
    > I fail to see how it being exposed to the javascript running on the page or not makes a meaningful difference to the user. Are we expecting the average user to interact with the page via the developer console or something? No, but I'm expecting the average user to be able to enjoy an open ecosystem. Such as bookmarklet, addons, client side widgets, electron apps, WASM plugins, and all the wonderful things we can't yet think of now. Instead, we will have one more walled garden. And just like that, piece by piece, the next step in the IT revolution will be more and more close. Because that's the plan, that's what they want. Something the computer runs, but has no control over.
    - gruez 5y ago
      >No, but I'm expecting the average user to be able to enjoy an open ecosystem. Such as bookmarklet, addons, client side widgets, electron apps, WASM plugins, and all the wonderful things we can't yet think of now. But there's still webgl and <canvas>. I'm failing to see what type of use cases we're missing out on here, because javascript access is missing.
  - deleted 5y ago
    [deleted]
- imwillofficial 5y ago
  Closed software? You mean being used by every person on earth every day of their lives?
  - BiteCode_dev 5y ago
    People also consume refined sugar, alcohol, saturated fat and cigarettes regularly. Just because something is common doesn't mean it's good for you. I'm not against closed software mind you, I'm using some myself, but the web as a platform has reached this amazing stage because it's been built on openness. And now the very same companies that became rich thanks to this openness want to close it to get all the benefits for themself.

snet0 5y ago

My understanding is basically that DRM is the technology that permits the existence of Netflix and similar. Perhaps I just lack a strength of principle, but I don't see why you'd remove one of the most-enjoyed aspects of the internet for the sake of uh... some kind of privacy-adjacent something?

tehbeard 5y ago
We got to an ok compromise of video tags and native browser support, with DRM extension for corporate needs/reqs... Is it the best? No. Could it worse, definitely. But without it youd need a Netflix app on your PC... And what safeguards does that have from hoovering my pc usage up for sale or marketing? Atleast Netflix only gets MY Netflix consumption for their metrics and ML, and isn't cross referencing the games I play or other things I'm doing at the same time.
- snet0 5y ago
  In addition to the privacy concerns with native applications, they're almost always insecure. One thing that is nice about modern browsers is that (despite Safari's leisurely update cycle) they are actually relatively secure, as far as software goes. Threats to the average user of Chrome are things like phishing, rather than RCE, and tab isolation keeps things from escalating out of control. Contrast that to the now ubiquitous conferencing software solutions, and it seems like every day there's some zero-day RCE vulnerability or other spooky exploit. If we needed to install and run a dozen different closed-source executables from BigCorp et al., I predict that we'd very soon go back to security dark-ages.
frostburg 5y ago
Isn't everything on Netflix ripped as soon as it is available? What is the DRM doing? Compliance?
dangerface 5y ago
Netflix make money from their subscription service not DRM. I can easily torrent anything I watch on netflix but I watch it on netflix because its easier. Thats why I pay for netflix its not because their DRM prevents me from pirating anything.

Telemakhos 5y ago

As I understand it, this is not so much about DRM as it is about privacy. The new model tag allows the browser to sandbox the display of a 3d object without reporting information back to the web page/server. This way, the browser can use camera data to track the user eye position relative to the device for parallax or to show what is behind the device to accomplish the effect known as "augmented reality." In other words, Apple wants developers to be able to deploy augmented reality experiences on the web without giving them access to the user's camera, which is a privacy issue.

dheera 5y ago
Hmmm I wonder if this would open more side channel attacks to extract information about the user without even going through a permissions dialog.