[Bug 26332] Applications should only use EME APIs on secure origins (e.g. HTTPS)

https://www.w3.org/Bugs/Public/show_bug.cgi?id=26332

--- Comment #34 from David Dorwin <ddorwin@google.com> ---
This is off topic, but for the record:

(In reply to Ryan Sleevi from comment #25)
> (In reply to Mark Watson from comment #24)
> > This is not an open plugin API with user-installable CDMs.
> 
> While I appreciate you making this point, I feel that this is just your
> opinion. Both of your co-editors, and their respective organizations, have
> positioned EME/CDM as precisely that, both in public discussions and, on a
> more practical matter, within the code itself.

I don't believe this is true (for me and Google, at least).

...
> On Google's side, EME/CDM is exposed through the Pepper plugin interface,
> Google's replacement for NPAPI. Indeed, even the existing EME
> implementations in Chrome are progrmatically no different than generic
> plugins.

This is not an accurate description of Chrome's implementation. On desktop
platforms, Chrome hosts CDMs in a Pepper process. However, this is an internal
implementation detail and the interface to the CDM is actually different. Also,
it is not possible to add a key system by installing a "plugin".

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Tuesday, 19 August 2014 21:02:30 UTC