665395 - there should be a pref to completely disable media including disable Audio API extension (window.Audio object)

Status: NEW

(Core :: Audio/Video: Playback, defect, P3)

Description

[al_9x]

User-Agent:       Mozilla/5.0 (Windows NT 5.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Build Identifier: 

a) to avoid potentially surprising, annoying and unwelcome audio
b) for security hardening purposes, most serious vulnerabilities are JS + API, so it should be possible to disable non core APIs one doesn't need.

Reproducible: Always

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

So what is this bug about?
window.Audio is the constructor for audio element, which is part of the
HTML spec.

Is this bug about disabling the moz-prefixed methods in the Audio element or
about disabling Audio altogether?

Comment 2

[al_9x]

(In reply to comment #1)
> So what is this bug about?

This intent is letting the user control whether his browser gets to play unsolicited audio from arbitrary websites.  A first step in this effort should be a global switch to disable audio output.  Per site permissions can come later.

This should be accomplished by denying access to the API (as opposed to setting the volume really low), which as an added bonus gives you enhanced security.

> Is this bug about disabling the moz-prefixed methods in the Audio element or
> about disabling Audio altogether?

I did notice the media.*.enabled prefs which presumably can block media playback through audio/video DOM elements, but they don't apply to the extension.

It probably makes sense for the global switch I am proposing to affect all media, so something like: media.enabled, which will completely disable <audio> <video> elements/objects.  Should this bug be repurposed for that, or a different one created?

Comment 3

[al_9x]

Bug 665598