{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/standards-positions/issues/58","repository_url":"https://api.github.com/repos/mozilla/standards-positions","labels_url":"https://api.github.com/repos/mozilla/standards-positions/issues/58/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/standards-positions/issues/58/comments","events_url":"https://api.github.com/repos/mozilla/standards-positions/issues/58/events","html_url":"https://github.com/mozilla/standards-positions/issues/58","id":300820600,"number":58,"title":"RFP: WebMIDI","user":{"login":"qdot","id":34539,"avatar_url":"https://avatars1.githubusercontent.com/u/34539?v=4","gravatar_id":"","url":"https://api.github.com/users/qdot","html_url":"https://github.com/qdot","followers_url":"https://api.github.com/users/qdot/followers","following_url":"https://api.github.com/users/qdot/following{/other_user}","gists_url":"https://api.github.com/users/qdot/gists{/gist_id}","starred_url":"https://api.github.com/users/qdot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/qdot/subscriptions","organizations_url":"https://api.github.com/users/qdot/orgs","repos_url":"https://api.github.com/users/qdot/repos","events_url":"https://api.github.com/users/qdot/events{/privacy}","received_events_url":"https://api.github.com/users/qdot/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":31,"created_at":"2018-02-27T22:38:57Z","updated_at":"2018-03-02T11:07:23Z","closed_at":null,"author_association":"MEMBER","body":"## Request for Mozilla Position on an Emerging Web Specification\r\n\r\n* Specification Title: WebMIDI\r\n* Specification or proposal URL: https://webaudio.github.io/web-midi-api/\r\n* Caniuse.com URL (optional): https://caniuse.com/#feat=midi\r\n* Bugzilla URL (optional): https://bugzilla.mozilla.org/show_bug.cgi?id=webmidi\r\n\r\n### Other information\r\n\r\nWebMIDI has been in development in Firefox since 2015. The DOM API (https://bugzilla.mozilla.org/show_bug.cgi?id=1201590) recently landed, but is pref'd off on all branches, runs only in tests, and was mostly landed to curb bit-rot. Platform implementation bugs exist at:\r\n\r\n- Mac: https://bugzilla.mozilla.org/show_bug.cgi?id=1201593\r\n- Windows:  https://bugzilla.mozilla.org/show_bug.cgi?id=1201596\r\n- Linux: https://bugzilla.mozilla.org/show_bug.cgi?id=1201598\r\n\r\nThe major blocker right now is security issues related to device firmware hijacking. There's a public google doc available listing issues and ideas for mitigation at\r\n\r\nhttps://docs.google.com/document/d/1SjYRmNvQKxOPHufWbx6n0NOeTKKd_O1WIiTBZAjVj5E/edit#heading=h.lavkfo6fb57g"},"comment":{"url":"https://api.github.com/repos/mozilla/standards-positions/issues/comments/369892938","html_url":"https://github.com/mozilla/standards-positions/issues/58#issuecomment-369892938","issue_url":"https://api.github.com/repos/mozilla/standards-positions/issues/58","id":369892938,"user":{"login":"dvhdr","id":1968458,"avatar_url":"https://avatars3.githubusercontent.com/u/1968458?v=4","gravatar_id":"","url":"https://api.github.com/users/dvhdr","html_url":"https://github.com/dvhdr","followers_url":"https://api.github.com/users/dvhdr/followers","following_url":"https://api.github.com/users/dvhdr/following{/other_user}","gists_url":"https://api.github.com/users/dvhdr/gists{/gist_id}","starred_url":"https://api.github.com/users/dvhdr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dvhdr/subscriptions","organizations_url":"https://api.github.com/users/dvhdr/orgs","repos_url":"https://api.github.com/users/dvhdr/repos","events_url":"https://api.github.com/users/dvhdr/events{/privacy}","received_events_url":"https://api.github.com/users/dvhdr/received_events","type":"User","site_admin":false},"created_at":"2018-03-02T11:07:23Z","updated_at":"2018-03-02T11:07:23Z","author_association":"NONE","body":"I’d argue that this attack opportunity already exists, in a more easily exploited form. To attack a USB MIDI device currently, you could:\r\n\r\n1. Craft malicious firmware for a popular device\r\n2. Embed said firmware in an enticing looking session file or synth patch dump\r\n3. Create a malicious site - no need for HTTPS (but why bother, just use one of the existing patch or session sharing sites)\r\n4. Wait for users to download it using their trusted browser and install it using their trusted DAW\r\n\r\nAt no point are they warned that this could be dangerous. There’s no “this file could harm your computer” at the point of download, because it’s not an executable. There's no warning from the DAW that sending sysex could be dangerous.\r\n\r\nWith sysex dumping from the browser, we’re _already_ in a better position - at least there is a chance to warn the user that the content may be unsafe!\r\n"}}
{"actor":{"display_login":"dvhdr"}}