As far as I read the spec, websites can't probe the local network. The UAs are supposed to do that periodically and expose the list of media services they maintain when asked.<div><br></div><div>Having said that, I agree that I don't think asking the user whether it's okay for a website to discover media sources or output in the local network is not a good security model.</div>
<div><br></div><div>For starters, most of users wouldn't even know what a local network is; let alone what discovering media sources, etc... mean.</div><div><br></div><div>It's also a very good way to finger-print users. How many users have the <span></span>same set of speakers, etc... let alone the same set of media contents.</div>
<div><br></div>- R. Niwa<br><div><br>On Saturday, August 31, 2013, Alexey Proskuryakov wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word">
<br><div><div>30.08.2013, в 15:53, Dirk Pranke <<a href="javascript:_e({}, 'cvml', 'dpranke@chromium.org');" target="_blank">dpranke@chromium.org</a>> написал(а):</div><br><blockquote type="cite"><div>
<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="word-wrap:break-word"><div><blockquote type="cite" style="font-family:Helvetica;font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">
<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">The draft does contain the sentence "Web pages should not be able to communicate with Local-networked Services that have not been authorized by the user thereby maintaining the user's privacy" in the use cases section; this should definite be emphasized and fleshed out, in a security section.</div>
</div></div></blockquote><div style="font-family:Helvetica;font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">
<br></div></div>How does the user know what they're doing? If there's an ad/unescaped comment containing something malicious should a remote site be able to know what services you have in your internal network?<br>
</div></blockquote><div><br></div><div>I'm not sure I understand your question, but I'm talking about the user having to opt-in to disclosing services, similar to the opt-ins we do for geolocation, media capture, local files, etc., e.g., "Spotify would like to know if you have any local media receivers", etc. ...</div>
</div></div></div></div></blockquote></div><div><br></div>"Would you like to install malware onto all networked printers in your office? Please click OK to get rid of this dialog, and finally start the browser game you want to play."<div>
<br><div>
<span style="border-collapse:separate;border-spacing:0px;font-size:12px"><div>- WBR, Alexey Proskuryakov</div><br></span>
</div>
<br></div></div></blockquote></div><br><br>-- <br>- R. Niwa<br>