5 ms·
I don't think the plugin APIs like NPAPI are the relevant attack surface, because in most cases, they are only accessible with explicit user permission, i.e. by
by takluyver 13y ago
I don't think the plugin APIs like NPAPI are the relevant attack surface, because in most cases, they are only accessible with explicit user permission, i.e. by installing a plugin. We should be primarily concerned with what an untrusted page can do without user action beyond visiting it. In that sense, getting rid of Flash is a big win.
- azakai 13y agoIs this getting rid of Flash, though? Many sites will still use Flash, and EME will not work in all browsers, because EME DRM plugins will only ship in browsers that manage to strike deals with Netflix/Hollywood/etc. - in particular, not in open source browsers.