[whatwg] Video with MIME type application/octet-stream

[Gregory Maxwell]

On Mon, Sep 6, 2010 at 3:19 PM, Aryeh Gregor <Simetrical+w3c at gmail.com> wrote:
> On Mon, Sep 6, 2010 at 4:14 AM, Philip Jägenstedt <philipj at opera.com> wrote:
>> The Ogg page begins with the 4 bytes "OggS", which is what Opera (GStreamer)
>> checks for. For additional safety, one could also check for the trailing
>> version indicator, which ought to be a NULL byte for current Ogg. [1] [2]
>
> "OggS\0" as the first five bytes seems safe to check for.  It's rather
> short, I guess because it's repeated on every page, but five bytes is
> long enough that it should occur by random only negligibly often, in
> either text or binary files.

Um... If you do that you will fail to capture on files that most other
ogg reading tools will happily capture on.  Common software will read
forward until it hits OggS then it will check the page CRC (in total,
9 bytes of capture).  For example, here is a file which begins with a
kilobyte of \0: http://myrandomnode.dyndns.org:8080/~gmaxwell/test.ogg
 Everything I had handy played it.

This could fail to capture on a live stream that didn't ensure new
listeners began at a page boundary. I don't know if any of these
exist.

I don't know if breaking these cases would matter much but herein lies
the danger of sniffing— everyone thinks they're an expert but no one
really has a handle on the implications.