Given the security flaws that have been recently disclosed, http://contextis.co.uk/files/Browser_Timing_Attacks.pdf
I think that it would make more sense to first try to see to what extent we manage to fix these issues, see what is left of SVG filters after these issues are fixed, and only then consider propagating these concepts to more Web APIs. (I know that an effort is under way on a tentative secure implementation of filters. That's great. I'm just saying, let's just finish and evaluate that first). If we really care about these features, since the current security model make them an inherently difficult trade-off between features, performance and security, I would rather have us think of a better security model first. If the intended use case is Shumway, so that --- I guess --- these filters are intended to be applied mostly to plain text and same-origin images/video and origin-clean canvases, then for this particular case, we could have a "safe to read back pixels from" concept for DOM elements and restrict filters to that. That's considerably more limited security model than what SVG/CSS filters currently claim to apply to, but it may be enough for the most important Shumway use cases. Benoit 2013/8/8 Jet Villegas <[email protected]> > Shumway team still needs to implement filter effects available in the > Flash Player. Ideally, fast filters can be made available to all Canvas > programs. Now that we've got a shared filter pipeline with SVG and CSS, can > we surface the same filters as a Canvas API? > > I'm attaching our last e-mail thread on the subject for context. > > --Jet > > ----- Original Message ----- > From: "Jeff Muizelaar" <[email protected]> > To: "Tobias Schneider" <[email protected]> > Cc: "Jet Villegas" <[email protected]>, "Benoit Jacob" <[email protected]>, > "Joe Drew" <[email protected]>, "Boris Zbarsky" <[email protected]>, "L. > David Baron" <[email protected]>, "Robert O'Callahan" < > [email protected]>, "Jonas Sicking" <[email protected]>, "Bas > Schouten" <[email protected]> > Sent: Friday, July 20, 2012 8:17:44 AM > Subject: Re: Native implementation of Flashs ColorMatrix filter > > This is not that easy for us to do. The only Azure backend that makes this > easy is Skia. None of CoreGraphics, Cairo or Direct2D support this > functionality. > > We could do hardware/software implementations on top of those APIs as we > do with SVG but I'm not in a huge rush to do this work. > > -Jeff > > On 2012-07-19, at 9:20 AM, Jet Villegas wrote: > > > Here's a request from the Shumway team re: Canvas2D graphics. Can we > surface this API? > > > > -- Jet > > > > ----- Forwarded Message ----- > > From: "Tobias Schneider" <[email protected]> > > To: "Jet Villegas" <[email protected]> > > Sent: Thursday, July 19, 2012 8:40:52 AM > > Subject: Native implementation of Flashs ColorMatrix filter > > > > Hi Jet, > > > > as already discussed in some meetings, it would be big performance > benefit for Shumway if we could implement Flashs ColorMatrix filter > natively as an extension to the Canvas API. ColorMatrix filters (or more > the ColorTransformation, which can be easily converted to a ColorMatrix) > are used really often in Swiff files, e.g. there is no way no change a > display objects opacity except of using a color transformation (or via > script of course), so its really a highly needed feature for Shumway. And > doing bitmap filter operations pixel wise with plain Javascript is just too > slow to archive a decent frame rate (especially since Canvas is hardware > accelerated, which makes using getImageData a pain in the ass). > > > > You can find out more about the ColorMatirx filter in the SWF spec or > here: > http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/flash/filters/ColorMatrixFilter.html > > > > Firefox already implements a ColorMatrix filter in its SVG > implementation, but since SVG is currently using the Skaia graphics > backend, I'm not sure if its possible to use them internally within the > Canvas API, which is based on Azure/Cairo. > > > > So I digged a little bit deeper into Azure to see where it could be > implemented, and i think the way we blur pixels to draw shadows is kinda > similar. So maybe we can reuse a lot of that for additional bitmap filters. > > > > The Canvas API for it can look pretty simple, we just need a way to > assign the ColorMatrix values as an array to a context property like so: > > > > ctx.mozColorMatrix = [1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, > 0, 1, 0]; > > > > I'm pretty sure that once we've created the infrastructure to support > bitmap filters on a Canvas, its easy to implement more Flash filters if > needed. I would start with the ColorMatrix filters since its the most used > and also a lot of other filter effects can be archived with the same effect > using a ColorMatrix. > > > > What do you think? Is it worth it to talk to the gfx guys during the > work week? > > > > > > Tobias > > > > _______________________________________________ > dev-platform mailing list > [email protected] > https://lists.mozilla.org/listinfo/dev-platform > _______________________________________________ dev-platform mailing list [email protected] https://lists.mozilla.org/listinfo/dev-platform
