> Web browser vendors have been reluctant to implement it because of increases attack surface, and of course web sites will not use it without browser support.

> Web browser vendors have been reluctant to implement it because of increases attack surface, and of course web sites will not use it without browser support. I believe codecs should actually be part of the OS. There should be one good, well-tested implementation per OS that browsers and other apps just link to. It might actually be possible to sandbox the codec components for increased security. Ideally, a web browser would just be a HTML+stuff parser, a layout engine, and a bit of gui, and shell out to the OS for everything else. Unfortunately, it seems the monolithic kitchen sink model has won.