<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Jul 2, 2010, at 12:09 PM, John Harding wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><br><br><div class="gmail_quote">On Thu, Jul 1, 2010 at 9:16 PM, Aryeh Gregor <span dir="ltr"><<a href="mailto:Simetrical%2Bw3c@gmail.com">Simetrical+w3c@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im">> As several people pointed out (and which I tried to get at in my post), this</div><div class="im">
> is really an ecosystem issue rather than a change needed in the spec or in<br>
> browsers. I suspect it's going to take some time, but the flexibility of<br>
> embedding content via <iframe> will be a big step forward.<br>
<br>
</div>Wouldn't it be straightforward for YouTube to offer <iframe> support<br>
right now, in addition to <object>? The backend support should be<br>
simple to do. If you keep the <object> code as the default embed<br>
recommendation and hide the <iframe> embed code somewhere so people<br>
will only use it if they look for it, you won't risk confusing anyone.<br>
Sites that currently whitelist <object> from YouTube will eventually<br>
whitelist <iframe> from YouTube too -- I hope there aren't many sites<br>
that permit *arbitrary* <object>s to be inserted by untrusted users.<br>
Allowing <iframe> will have other benefits, like allowing fallback<br>
"install Flash" content (currently omitted from the <object> code, I<br>
assume to keep the size down).<br></blockquote><div>Yes, it's pretty straightforward to offer <iframe>-based embed code, but it needs to be coupled with getting sites to accept them, or we end up with a lot of confused, unhappy users. Note that sites don't generally whitelist specific SWFs - they generally allow all Flash embeds. </div></div></blockquote><div><br></div><div>Any site which does that has a giant security hole, since Flash can be used to arbitrarily script the embedding page. It's about as safe as allowing embedding of arbitrary off-site <script>. If you are aware of sites that allow embedding of arbitrary off-site Flash, you should alert them to the potential security risks. For example a social network site that allowed this would be vulnerable to a self-propagating worm.</div><div><br></div><div>What I have heard before is that sites whitelist specific SWFs or Flash from specific domains. I'm don't have any first-hand knowledge of how sites actually do it.</div><div><br></div></div><div>Regards,</div><div>Maciej</div><div><br></div></body></html>