Standards for Web Applications on Mobile: Current State and Roadmap
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
M3AAWG Best Common Practices for Mitigating Abuse of Web Messaging Systems, Version 1.1 Updated March 2019 (2010)
Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) M3AAWG Best Common Practices for Mitigating Abuse of Web Messaging Systems, Version 1.1 Updated March 2019 (2010) The reference URL for this document is www.m3aawg.org/WebMessagingAbuse Table of Contents Updated in this Version ......................................................................................................................................................... 1 Introduction ........................................................................................................................................................................... 1 Typical Attacks ...................................................................................................................................................................... 2 Monitoring and Alerting ....................................................................................................................................................... 2 Proactive Defense .................................................................................................................................................................. 3 UI Access ........................................................................................................................................................................................................... 3 Web Application Security .............................................................................................................................................................................. -
Cross-Domain Communications
CSE 361: Web Security Cross-domain Communication Nick Nikiforakis 2 A World Without Separation between Sites http://kittenpics.org https://gmail.com 3 The Same-Origin Policy for JavaScript • Most basic access control policy • controls how active content can access resources • Same-Origin Policy for JavaScript for three actions • Script access to other document in same browser • frames/iframes • (popup) windows • Script access to application-specific local state • cookies, Web Storage, or IndexedDB • Explicit HTTP requests to other hosts • XMLHttpRequest 4 The Same-Origin Policy for JavaScript • Only allows access if origins match Protocol Hostname Port • Origin defined by protocol, hostname, and port http://example.org:80/path/ Originating document Accessed document Non-IE Browser Internet Explorer http://example.org/a http://example.org/b http://example.org http://www.example.org http://example.org https://example.org http://example.org http://example.org:81 5 Domain Relaxation • Two sub-domains of a common parent domain want to communicate • Notably: can overwrite different port! • Browsers allow setting document.domain property • Can only be set to valid suffix including parent domain • test.example.org -> example.org ok • example.org -> org forbidden • When first introduced, relaxation of single sub-domain was sufficient • Nowadays: both (sub-)domains must explicitly set document.domain 6 Domain Relaxation http://sub.kittenpics.org http://kittenpics.org document.domain = "kittenpics.org" document.domain = "kittenpics.org" 7 Domain Relaxation http://sub.kittenpics.org http://kittenpics.org document.domain = "kittenpics.org" Cross-Origin Communication 9 Cross-origin communication • Subdomains of the same domain can use domain relaxation when they want to talk to one another. -
Tr 126 907 V14.0.0 (2017-04)
ETSI TR 126 907 V14.0.0 (2017-04) TECHNICAL REPORT Universal Mobile Telecommunications System (UMTS); LTE; HTML5 for a new presentation layer in 3GPP services (3GPP TR 26.907 version 14.0.0 Release 14) 3GPP TR 26.907 version 14.0.0 Release 14 1 ETSI TR 126 907 V14.0.0 (2017-04) Reference RTR/TSGS-0426907ve00 Keywords LTE,UMTS ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N° 348 623 562 00017 - NAF 742 C Association à but non lucratif enregistrée à la Sous-Préfecture de Grasse (06) N° 7803/88 Important notice The present document can be downloaded from: http://www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at https://portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https://portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. -
WAVE Interoperability Boot Camp
Thank You to Our Sponsors WAVE Interoperability Boot Camp October 2nd, 2018 Technology & Standards Forum | Los Angeles, CA AGENDA • Introduction to WAVE – Paul Hearty, Sony Electronics • Presentations: • WAVE Technical Overview – Will Law, Akamai • WAVE Content Specification – Mike Bergman, CTA • WAVE Applications Environment – Mark Vickers, Comcast • WAVE Device Playback Capabilities – Mike Bergman, CTA • WAVE Test Suites – Mike Bergman, CTA • Q&A/Wrap-up – Paul Hearty, Moderator Overview of the WAVE Project Paul Hearty / Sony Electronics, Inc. Introduction to WAVE • What are the problems WAVE is addressing? • What are the WAVE solutions? • WAVE participating companies • WAVE work structure Supporting a fragmented OTT world • Fragmentation impacts content providers and device makers: • Multiple streaming formats (HLS, HDS, DASH, Smooth) • Multiple device types from laptops to phones to gaming consoles • Inconsistent device performance capabilities • Inconsistent device compliance to industry specifications • The result: • Content providers: Increased cost to prepare, store and support OTT • Device makers: Increased test and support costs for devices Commercial OTT Video Issues: WAVE Solution Device Playback Device HTML5 Reference Content Capabilities Platform Content Specification Testable requirements Reference application • Based on MPEG Common • covering most common framework Media Application Format playback interoperability • Based on HTML5 (CMAF) issues. • Provides functional • Compatible with DASH and guidelines for playback HLS. -
Specification for Devices 2020
Certify Devices Specification for Devices 2020 Version: 4.20-r1 Date: 2019-12-19 Specification for Devices 2020, v4.20 © Vewd Software AS 2020. All rights reserved. _____________________________________________________________________________________ CONTENTS 1. REVISION HISTORY 2. INTRODUCTION 2.1. Scope 2.2. Versions for requirements and software 2.2.1. Backward compatibility 2.3. Definitions 2.4. Compliance terminology used in this document 2.4.1. REQUIRED and CONDITIONALLY REQUIRED features 2.4.1.1. DRM 2.4.1.2. Codecs and media formats 2.4.1.3. Keys on the remote control 2.4.1.4. Resolution 3. TECHNICAL REQUIREMENTS 3.1. HTML5 <video> and <audio> 3.1.1. Media element 3.1.1.1. Requirements for video and audio media elements 3.1.1.2. Requirements for video media elements 3.1.1.3. Codec support 3.1.2. Track element 3.1.2.1. Requirements for all track elements 3.1.2.2. Requirements for text track elements 3.2. Media streaming 3.2.1. Transport protocols 3.2.2. Progressive download 3.2.3. Adaptive Bitrate streaming protocols 3.2.3.1. Apple HTTP Live Streaming (HLS) 3.2.3.1.1. Restrictions for HLS content 3.2.3.2. MPEG-DASH 3.2.3.2.1. Restrictions for MPEG-DASH content 3.2.3.3. Microsoft Smooth Streaming (MSSS) 3.2.3.3.1. Restrictions for Smooth Streaming content 3.3. Media Source Extensions (MSE) 3.4. Subtitles and Closed Captioning 3.5. DRM 3.5.1. Content Decryption Modules (CDMs) 3.5.1.1. ClearKey 3.5.1.2. -
Media Source Extensions
static void _f_do_barnacle_install_properties(GObjectClass *gobject_class) { GParamSpec *pspec; Media Source Extensions /* Party code attribute */ pspec = g_param_spec_uint64 (F_DO_BARNACLE_CODE, "Barnacle code.", "Barnacle code", on WebKit using GStreamer 0, G_MAXUINT64, G_MAXUINT64 /* default value */, G_PARAM_READABLE | G_PARAM_WRITABLE | G_PARAM_PRIVATE); g_object_class_install_property (gobject_class, F_DO_BARNACLE_PROP_CODE, Enrique Ocaña González [email protected] Motivation for MSE ● HTML5 video tag: <video src=ºmovie.mp4º type=ºvideo/mp4º /> ● Improvement: Blob URI ● Adaptive streaming and time shift limitations ● Solution: Media Source Extensions (MSE) https://w3c.github.io/media-source/ ● JavaScript can generate and feed video data ● More control on the player state How to use MSE SourceBuffer ● Append API for JavaScript: Data... ● HTMLMediaElement, Blob SourceBuffer ● MediaSource, SourceBuffer MediaSource ● Blob URL {Audio,Video,Text}Track HTMLMediaElement <audio> <video> <video id="video"></video> MediaPlayer <script> var video = document.getElementById(©video©); var ms = new MediaSource(); ms.addEventListener(©sourceopen©, function() { var videoSb = ms.addSourceBuffer(©video/mp4; codecs="avc1.640028"©); var audioSb = ms.addSourceBuffer(©audio/mp4; codecs="mp4a.40.2"©); videoSb.appendData(...); audioSb.appendData(...); }); var blobUrl = URL.createObjectURL(ms); video.src = blobUrl; </script> Design PlatformTimeRanges m_mediaSource m_mediaElement MediaSource SourceBuffer PrivateClient PrivateClient MediaPlayer m_client MediaPlayerClient -
A Trusted Infrastructure for Symbolic Analysis of Event-Driven Web
A Trusted Infrastructure for Symbolic Analysis of Event-Driven Web Applications Gabriela Sampaio Imperial College London, UK [email protected] José Fragoso Santos INESC-ID/Instituto Superior Técnico, Universidade de Lisboa, Portugal Imperial College London, UK [email protected] Petar Maksimović Imperial College London, UK [email protected] Philippa Gardner Imperial College London, UK [email protected] Abstract We introduce a trusted infrastructure for the symbolic analysis of modern event-driven Web applica- tions. This infrastructure consists of reference implementations of the DOM Core Level 1, DOM UI Events, JavaScript Promises and the JavaScript async/await APIs, all underpinned by a simple Core Event Semantics which is sufficiently expressive to describe the event models underlying these APIs. Our reference implementations are trustworthy in that three follow the appropriate standards line-by-line and all are thoroughly tested against the official test-suites, passing all the applicable tests. Using the Core Event Semantics and the reference implementations, we develop JaVerT.Click, a symbolic execution tool for JavaScript that, for the first time, supports reasoning about JavaScript programs that use multiple event-related APIs. We demonstrate the viability of JaVerT.Click by proving both the presence and absence of bugs in real-world JavaScript code. 2012 ACM Subject Classification Software and its engineering → Formal software verification; Software and its engineering → Software testing and debugging Keywords and phrases Events, DOM, JavaScript, promises, symbolic execution, bug-finding Digital Object Identifier 10.4230/LIPIcs.ECOOP.2020.28 Acknowledgements Fragoso Santos, Gardner, and Maksimović were partially supported by the EPSRC Programme Grant ‘REMS: Rigorous Engineering for Mainstream Systems’ (EP/K008528/1) and the EPSRC Fellowship ‘VetSpec: Verified Trustworthy Software Specification’ (EP/R034567/1). -
Get Started with HTML5 ● Your Best Bet to Experiment with HTML5 – Safari – Chrome As of – Beta: Firefox 4 and IE 9
BibhasBibhas BhattacharyaBhattacharya CTO,CTO, WebWeb AgeAge SolutionsSolutions [email protected]@webagesolutions.com www.webagesolutions.com/trainingwww.webagesolutions.com/training Get Started With HTML5 ● Your best bet to experiment with HTML5 – Safari – Chrome As of – Beta: FireFox 4 and IE 9. October 2010 ● Test your browser: – html5test.com – html5demos.com – www.findmebyip.com/litmus ● JavaScript library to test for HTML5 features – www.modernizr.com Browser Support ● Dreamweaver CS5 11.0.3 update will install HTML5 compatibility pack. ● CS4 and CS3 users should download the pack from Dreamweaver Exchange. ● See a demo: – www.youtube.com/watch?v=soNIxy2sj0A DreamWeaver Story - The canvas element - Custom audio & video player - New semantic elements - Geolocation (header, section, footer etc.) - Local data storage - New form input elements - Web SQL & IndexedDB (e-mail, date, time etc.) - Offline apps - Audio and video - Messaging - CSS3 - Web worker - Push using WebSocket For web page designers For developers What's New in HTML5? SimplifiedSimplified <!DOCTYPE html> DOCTYPEDOCTYPE <html> <head> <title>Page Title</title> Simplified <meta charset="UTF-8"> Simplified charsetcharset settingsetting </head> <body> <p>Hello World</p> </body> </html> Basic HTML 5 Document ● Elements that have no special visual styling but are used to provide structure and meaning to the content. ● HTML4 semantic elements – div (block) – span (in line) ● HTML5 semantic elements – header, footer, section, article, aside, time and others.. -
Web Messaging and Notification System Between Journalists And
FACULDADE DE ENGENHARIA DA UNIVERSIDADE DO PORTO Web messaging and notification system between journalists and citizens Cláudia Margarida da Rocha Marinho Mestrado Integrado em Engenharia Informática e Computação Supervisor: Maria Teresa Magalhães da Silva Pinto de Andrade Second Supervisor: Pedro Miguel da Silva Santos July 19, 2019 Web messaging and notification system between journalists and citizens Cláudia Margarida da Rocha Marinho Mestrado Integrado em Engenharia Informática e Computação Approved in oral examination by the committee: Chair: Jorge Manuel Gomes Barbosa (Assistant Professor) External Examiner: Paula Viana (Coordinator Professor) Supervisor: Maria Teresa Andrade (Assistant Professor) July 19, 2019 Abstract Over the recent years, live streaming has become a popular trend among events’ attendees, al- lowing them to share their own experiences of the event with people around the world. Realizing that this might be an opportunity for content providers to enrich their coverage of large events by making use of the attendees’ contributions, MOG Technologies started a project in a partnership with INESC TEC, Jornal de Notícias and OSTV. The idea of the project is to offer simple means for the event attendees, who can be general public or professional reporters, to send video streams in real-time to the TV producer who is covering the event and live broadcasting it to the public. The video streams are captured with the smartphones of the attendees through an intuitive web app. On the production side, the intention is to allow the TV event producer to continuously browse through the different received feeds using a drag-and-drop web-based GUI and, at any instant, to select a given feed to be inserted automatically in the main broadcast stream, which can also appear in the on-site large TV screens. -
Audioworklet: the Future of Web Audio
AudioWorklet: The future of web audio Hongchan Choi Google Chrome [email protected] ABSTRACT 1.2 Web Audio API processing model To appreciate the advantages of AudioWorklet over Script- This paper presents a newly introduced extension to the ProcessorNode, it is helpful to understand how Web Audio Web Audio API that enables developers to author custom API operates internally. The following is a quick recap of audio processing on the web. AudioWorklet brings JavaScript- the processing model embodied in the API specification. based audio processing that is fast, reliable and secure while addressing numerous problems found in the earlier Browser main thread High priority thread ScriptProcessorNode. AudioWorklet’s design is discussed, followed by technical aspects, usage examples, and what Control thread Render thread the new functionality offers to the computer music commu- User script nity. Audio graph code change update 1. BACKGROUND Command AudioNodes queue 1.1 What is AudioWorklet? Asynchronous messaging Since its birth in 2010, the Web Audio API [1] has trans- formed the web browser into a platform for interactive ap- Figure 1. The processing model of the Web Audio API plications for music and audio. Although it has been rea- sonably successful in accommodating various use cases Two crucial premises of the Web Audio API rendering with its highly dynamic design, there has been a major mechanism are that 1) the audio rendering needs to be per- criticism pointing out its lack of flexibility and extensi- formed on a dedicated thread with high priority and 2) the bility. Besides built-in features for basic audio processing rendering pipeline must have a fixed size render quantum and synthesis, the API also provided developers with a way of 128 frames. -
W2: Encoding 2017: Codecs & Packaging for Pcs, Mobile
W2: ENCODING 2017: CODECS & PACKAGING FOR PCS, MOBILE, & OTT/STB/SMART TVS Jan Ozer www.streaminglearningcenter.com [email protected]/ 276-235-8542 @janozer Agenda •Fundamentals •Targeting your platforms •Producing and delivering your streams •Configuring your streams Shameless Plug • All tables from this book • Published 12/16 • Retail - $49.95 – print • PDF - $39.95 • Show special: • $40 • PDF included no extra charge • Limited supply available (only books bought at show) Fundamentals • Compression related • Delivery paradigms • Bitrate control (CBR/VBR) • I-, B-, and P-frames • Choosing a codec • Codecs/container formats Compression-Related Fundamentals • Delivery paradigms: Single vs. Adaptive Bitrate (ABR) • Bitrate control techniques • I-, B- and P-frames Adaptive Streaming • Adaptive streaming • Delivered adaptively based upon playback CPU and • Single input file (live or VOD) connection bandwidth • Encoded to multiple outputs • Technically complex, but optimizes experience across all platforms and connection types Illustration courtesy of www.bitmovin.net Single vs. Adaptive • Single file delivers inferior experience • Very simple to achieve via Gen 1 HTML5 (video tag) and support in mobile • This approach excludes adaptive, DRM, live, and advertising support • Resources: • Webinar: Distributing to Desktops and Mobile Devices via HTML5 (bit.ly/Ozer_MSE_EME) • Video tutorial: Supporting HTML5 with Flash Fallback in Squeeze 9 (bit.ly/squeeze_html5) • Our focus is on adaptive delivery ABR Technology Overview • Two types of systems -
Hbbtv 2.0.3 Explained” Hbbtv Specification Naming
What's new in the HbbTV Specification “HbbTV 2.0.3 Explained” HbbTV Specification Naming Informal Name Formal Name HbbTV 1.0 TS 102 796 V1.1.1 HbbTV 1.5 TS 102 796 V1.2.1 HbbTV 2.0 TS 102 796 V1.3.1 HbbTV 2.0.1 TS 102 796 V1.4.1 HbbTV 2.0.2 TS 102 796 V1.5.1 HbbTV 2.0.3 TS 102 796 V1.6.1 (tbc) ??? ??? HbbTV Association | Copyright © HbbTV 2 3 Elements to HbbTV 2.0.3 • Errata to HbbTV 2.0.1/2 – Fixing bugs in the spec • Updates to existing features – Goal for 2.0.3 was “low hanging fruit” that are easy to specify & test • No big new features – these were deferred to the next iteration – Critical updates already widely supported in practice – One small new feature • Removing unused and replaced features – Cannot keep adding features and never removing anything HbbTV Association | Copyright © HbbTV 3 What are Errata? • Fixes to bugs in the spec • HbbTV publishes >1 document for each errata – May be cosmetic release • Punctuation, cross-references, … – A list of the changes to the specification(s) – Might be language that’s unclear or hard to – A version of the specification(s) with the errata understand integrated & changes tracked – May be ambiguities • All HbbTV errata have an issue number • Something that can genuinely be interpreted in – Issue numbers can be used to cross-reference more than one way between the two documents – May be conflicts & inconsistencies – HbbTV members can use the number to lookup • Statements that actually say different things the discussion in our issue tracking system – Things that are hard or even impossible