[Bug 26332] Applications should only use EME APIs on secure origins (e.g. HTTPS)

https://www.w3.org/Bugs/Public/show_bug.cgi?id=26332

--- Comment #125 from Anne <annevk@annevk.nl> ---
Here's a proposal.

1) We work out how to make non-TLS EME as good as possible for end users and if
UAs opt to support non-TLS (as everyone does at this point) they steer towards
implementing those requirements.

2) We deprecate non-TLS EME in the specification and recommend against
supporting it.

3) We set a date one or two years from now at a point when at least two UAs are
willing to disable non-TLS EME.

4) We advertize this date through console warnings, evangelism, and perhaps
even the specification.

This plan is similar to what has been proposed for WebRTC and geolocation and
seems reasonable given existing non-TLS deployment.

(We also make sure to not fall in this non-TLS trap again for new APIs.)

-- 
You are receiving this mail because:
You are the QA Contact for the bug.

Received on Wednesday, 29 October 2014 21:51:49 UTC