[Bug 25920] Remove extraction of default URL from createSession() algorithm

https://www.w3.org/Bugs/Public/show_bug.cgi?id=25920

Joe Steele <steele@adobe.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |steele@adobe.com

--- Comment #1 from Joe Steele <steele@adobe.com> ---
(In reply to David Dorwin from comment #0)
> The default URL steps in the createSession() algorithm allow a license
> server URL to be extracted from the Initialization Data.
> 
> However:
> * This is inconsistent with EME's application-driven model.

I disagree with this. This is yet another way for information to be provided to
the application by the content publisher. 

> * There is only one format that supports this, and it does so using
> proprietary header boxes.

This may or may not be true ( I know of at least one format that supports this)
but proprietary header boxes are the nature of CENC. Either we have that or we
do not support CENC.

> * Uses of it are unlikely to be interoperable.

This seems to be opinion rather than fact-based. Give me some evidence. 

> * There are no current implementations or applications using it.

This is not true. The Adobe Access implementation of EME uses this. And there
is a large amount of existing content using it that will be enabled once EME is
more widely deployed. 

> * There is a privacy and security risk in allowing media data to direct an
> application to ping/contact a random server.

I disagree. The contact here will be controlled via origin policy same as any
other web content loaded by the page. Please elaborate the risk you see.

> 
> Therefore, we should remove these steps.

I could not disagree more strongly.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Tuesday, 3 June 2014 13:33:44 UTC