I think this is an excellent point. I've been playing with the Chroma-Key replacement trick demonstrated in FireFox 3.1b3:<div><br></div><div><a href="https://developer.mozilla.org/samples/video/chroma-key/index.xhtml">https://developer.mozilla.org/samples/video/chroma-key/index.xhtml</a></div>
<div><a href="https://developer.mozilla.org/En/Manipulating_video_using_canvas">https://developer.mozilla.org/En/Manipulating_video_using_canvas</a></div><div><br></div><div>For my own experiments, I grabbed a green-screen video from Youtube and converted it to OGG. If the access control were in place for Canvas, I could have done direct compositing on an embedded video from TinyVid. Which would open up some interesting possibilities for video mashups on the web.</div>
<div><br></div><div>Thanks,</div><div>Jerason<br><br><div class="gmail_quote">On Fri, Mar 13, 2009 at 11:24 AM, Hans Schmucker <span dir="ltr"><<a href="mailto:hansschmucker@gmail.com">hansschmucker@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">This problem recently became apparent while trying to process a public<br>
video on <a href="http://tinyvid.tv" target="_blank">tinyvid.tv</a>:<br>
<br>
In article 4.8.11.3 "Security with canvas elements", the origin-clean<br>
flag is only set depending on an element's origin. However there are<br>
many scenarios where an image/video may actually be public and<br>
actively allowing processing on other domains (as indicated by<br>
Access-Control-Allow-Origin).<br>
<br>
Is this an oversight or is there a specific reason why Access Control<br>
for Cross-Site Requests should not work for Canvas?<br>
</blockquote></div><br></div>