- From: Noam Rosenthal via GitHub <sysbot+gh@w3.org>
- Date: Wed, 17 Jul 2024 07:07:25 +0000
- To: public-css-archive@w3.org
> Yeah, we have historically avoided the "snapshot the page into a canvas texture" issues because of the security concerns. (I think these are manageable, but it's been enough to stall previous efforts.) I think the main security issue would be WebGL timing attacks to read cross-origin non-isolated content. It would have to be enabled only in isolated environments and disallow reading iframes. I think the security issues are solvable but I agree none of this is trivial (hence: not on any short term work list). > I'm not sure this is a great idea, nor if it's straightforward, especially for the new capture which isn't a snapshot given its live nature. How is that conceptually different from painting from a video? You can get the live image with every `requestAnimationFrame`. I agree that this idea is not straightforward, however the use case exists. > I also wouldn't want people to suddenly start using View Transitions just to get snapshots (but not actually run a transition) Good point... We could perhaps do something more use-case specific, like allow a "big canvas mode" for the whole view transition that you can paint to, but you can't paint the images outside of that. -- GitHub Notification of comment by noamr Please view or discuss this issue at https://github.com/w3c/csswg-drafts/issues/10568#issuecomment-2232583799 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Wednesday, 17 July 2024 07:07:26 UTC