[Bug 21203] EME leaks information cross-origin

https://www.w3.org/Bugs/Public/show_bug.cgi?id=21203

--- Comment #5 from Mark Watson <watsonm@netflix.com> ---
(In reply to comment #4)
> (In reply to comment #3)
> > Henri - why is this different in character from the information about the
> > media file provided by the media element itself ? 
> 
> I'm not sure if initialization data is different in character. That's why I
> gave alternatives a and b under point 2. Even if initialization data and key
> IDs are deemed similar to duration, I think the spec should explicitly
> acknowledge the cross-origin information leak like the main spec does for
> duration.
> 
> > Such as duration, number
> > and type of tracks, timed text cues etc.
> 
> Per spec, text cues are not exposed without CORS.

Ok, it sounds to me like the exposure of initialization data and key ids is
similar to exposure of text cues (they could contain arbitrary information).
Can we just cut&paste or refer to text from the Media Element specification ?

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Wednesday, 6 March 2013 16:50:08 UTC