Re: [mediacapture-main] Iframe sandboxing options for gUM

> the sandbox model is so restrictive by default (and with a growing &
 unbounded set of restrictions) that it is unlikely to be used

Sandbox via iframe has a use count of 0.6% of sampled pages from 
Chrome's stats. Why do you think it is unlikely to be used? (There is 
no data for how many pages have a cross-origin iframe, though)

The sandbox model which has new potentially dangerous feature disabled
 by default is something we hope people to use for their cross-origin 
iframes in general, right?

And by making this feature disabled by default for even non-sandbox, 
aren't you just making the normal model be aligned with the sandbox 
model that has a growing and unbounded set of restrictions which you 
are disapproving?

> using `getUserMedia` from an iframe from a different origin ought to
 be the exception rather than the norm

This actually applies to many of other sandbox flags, including 
pointerlock, top navigation, modals, and probably even popups.

With time goes by, people may find new ways to escape from 
restrictions. By making restrictions a flag in sandbox, spec and impls
 are able to handle them altogether, rather than fixing each 
individual attributes.

Also without sandbox, pages can escape from this restriction via a top
 navigation or popup.

> Now if current usage doesn't allow that change, it is reasonable to 
reconsider that approach; but it would be useful to have more details 
on what metrics tell us (if we have any)

TBH, based on Chrome's stats, I don't think the usage would really be 
a blocker. (GetUserMediaInsecureOriginIframe <= 0.0001%, 
GetUserMediaSecureOriginIframe <= 0.0001%, so combined at most 
0.0002%)

-- 
GitHub Notification of comment by upsuper
Please view or discuss this issue at 
https://github.com/w3c/mediacapture-main/issues/268#issuecomment-231009332
 using your GitHub account

Received on Thursday, 7 July 2016 07:58:52 UTC