Re: [whatwg] sandboxed iframe allow-auto-play

On Fri, May 29, 2015 at 11:09 AM, Mike West <mkwst@google.com> wrote:

> Hi Benjamin!
>
> On Fri, May 29, 2015 at 4:27 PM, Benjamin Kelly <bkelly@mozilla.com>
> wrote:
> > Recently I was talking with a web developer who told me one of his
> biggest
> > problems is dealing with "bad ads" that play audio/video immediately.
> >
> > I was wondering if we could address this use case with some changes like:
> >
> > 1) Change sandboxed iframes to disable audio/video playing without user
> > interaction by default.
> > 2) Add a new sandbox token "allow-auto-play" that permits playing without
> > user interaction.
>
> This should already be covered by
>
> https://html.spec.whatwg.org/multipage/browsers.html#sandboxed-automatic-features-browsing-context-flag
> ,
> right? Note that it's tied to the `allow-scripts` keyword, as running
> script makes it trivial to trigger a play action.
>

Ah, thanks.  I was not aware of that.

It seems, though, we might want better granularity.  For example, an ad
could be interactive with script/etc, but it would be nice to block
auto-play before interaction.  The allow-scripts or not is kind of a big
hammer right now.

And yes, script can be used to start playing, but it seems the "no user
interaction" block could still be enforced on things like audio volume.
(Blocking animation or video playing would be a lot harder given someone
can do things manually with canvas, etc.)

Thanks again.

Ben

Received on Friday, 29 May 2015 16:04:03 UTC