- From: Philippe Le Hegaret via GitHub <sysbot+gh@w3.org>
- Date: Fri, 31 Mar 2017 20:44:22 +0000
- To: public-html-media@w3.org
plehegar has just created a new issue for https://github.com/w3c/encrypted-media: == Sandboxing expectation == Section 10.2 says: [[ User Agents are responsible for providing users with a secure way to browse the web, including any functionality, such as CDMs, from third parties [...] Exploiting a CDM implementation that is not fully sandboxed and/or uses platform features may allow an attacker to access OS or platform features [...] If a user agent chooses to support a Key System implementation that cannot be sufficiently sandboxed or otherwise secured, the user agent SHOULD ensure that users are fully informed and/or give explicit consent before loading or invoking it. ]] However, this expectation isn't really reflected earlier in the specification, especially the graph in Section 1 Introduction. #382 proposes to address this issue by adding a sandbox around the CDM in the graph. Please view or discuss this issue at https://github.com/w3c/encrypted-media/issues/383 using your GitHub account
Received on Friday, 31 March 2017 20:44:32 UTC