Sandboxing functions (was: Why ignoring unknown mandatory constraints is not stupid)

On 16/11/2013 1:07 AM, Jan-Ivar Bruaroey wrote:
> getUserMedia() doesn't force you to accept a camera, it finds and 
> grants access to the best camera available, as best it can (using 
> known info or the user's help). When things are unknown, we have a 
> choice: In one outcome the programmer has a candidate, access to query 
> it and the user's system, and in the other outcome, no access, no 
> candidate and an error. You wont even know if the error is legitimate 
> (user doesn't have it) or if the browser has blocked you. That doesn't 
> seem easier to me.

We keep on being asked to choose between ease of development and the 
client fingerprinting.

Instead of dealing with fingerprinting on a per-function basis, couldn't 
we let the developer pass in a function that accesses sensitive data and 
validate that function ahead of time to make sure that it does not leak 
this information by way of closures, network access, etc?

For example, replace "getUserMedia(constraints)" with 
"getUserMedia(filterFunction)" where "filterFunction" takes in one 
device at a time (with all its capabilities) and returns true if the 
device is a acceptable to the application. FilterFunction would then 
compare the camera resolution against fixed values (perhaps read from a 
closure, but never written to it).

Maybe getUserMedia() isn't the best example, but I hope you understand 
my point. According to http://stackoverflow.com/a/3379880/14731 I 
believe we can access a method's body reflectively. What are you 
thoughts on this?

Gili

Received on Monday, 18 November 2013 03:23:58 UTC