[Bug 20960] EME is not limited to video.

https://www.w3.org/Bugs/Public/show_bug.cgi?id=20960

--- Comment #8 from Joe Steele <steele@adobe.com> ---
> This is unique to the EME because of the back channel that EME provides from
> the CDM to the server.  An image decoder or a video decoder do not require a
> back channel.

Thank you. That makes the threat you are worried about more clear. 

Let me restate to make sure I understand:
* There is a bi-directional channel to the CDM from the web application
* This allows the web application to funnel all data and events the web
application sees to the CDM. 
* Because the CDM can implement any code it wants, it could implement an HTML
engine.
* The combination of these two things allows a CDM to render content from the
web application in an alternate HTML engine and process events for it

If we replace "CDM" with "video codec" in the above argument, I believe we have
the same situation. Video elements have a bi-directional channel as well in the
HTMLMediaElement text track support (textTracks and addTextTrack).

> DRM would be attractive to a wider range of content authors than just video 
> authors, 

I agree with this.

> and if a CDM can support DRM then there would be demand for more 
> general HTML support within the CDM - I suggest it's inevitable that a CDM 
> would be written that supports a relative comprehensive HTML engine.  

I don't agree with this. 

The described threat would require the UA to include a CDM with this behavior.
There is no requirement that any UA include any specific CDM other than
ClearKey (which does not have this behavior). A much shorter path to this
scenario is that the UA provides a direct non-standard method to turn on "DRM"
for the web page and does not include an entire alternate HTML engine. Both
scenarios require collusion by the UA implementer and both rely on behavior
outside of the specification.

Having said this -- it sounds like it would satisfy your concern to have some
spec text that says something along the lines of "The CDM must not implement a
user agent.". Do you have some alternate text to suggest?

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Wednesday, 20 February 2013 17:43:46 UTC