News for hackers. Stuff that matters.
Re:Safari on iOS can overlap multiple full-screen videos by Maursault on Thursday June 16, 2022 @12:42PM (#31768138)
> The user isn't the one intentionally opening these overlapping videos.

Yes, he absolutely is, and the proof is

> So here’s a tiny web page I created to play with it.

What OP is reporting is more accurately described as a possible memory overflow exploit. The software appears to be operating as designed, but a malicious attacker might be able to exploit the behavior to do bad things, though this is not exactly necessarily true, and we won't know until we see it happen.

Re:Safari on iOS can overlap multiple full-screen videos by function_seven on Thursday June 16, 2022 @12:47PM (#31768202)
This is weird. Okay, so it may not be a software bug at all, but I'm gonna move these goalposts and insist this is a product design bug, or something.

If this is intentional behavior, I don't understand the point. A full-screen video should be the only one playing IMO. Playing multiple (windowed) videos is one thing, but having 30 of them overlap full screen is quite another. And with no affordances to mass-terminate them, the result is unwanted behavior.

So: not a bug in the "off-by-one" or "use-after-free" sense, but damn if it ain't a close cousin.

Re:Safari on iOS can overlap multiple full-screen videos by Maursault on Thursday June 16, 2022 @01:04PM (#31768429)
> Playing multiple (windowed) videos is one thing, but having 30 of them overlap full screen is quite another.

Behavior can be duplicated on any modern computer, i.e. you can have as many overlapping fullscreen windows as memory will tolerate, probably thousands and much more than that. Why would anyone want to do that? To cry "bug," I imagine.

It may not be intentional design, but my point is that this is not a bug, by the definition of what a bug is. There is no actual error here. The code is operating as expected. There may be issues with the interface design, but there also very well may not be.

Re:Safari on iOS can overlap multiple full-screen videos by function_seven on Thursday June 16, 2022 @01:12PM (#31768498)
> The code is operating as expected

I highly doubt this. When Apple rolled out multiple video support, they did not expect that a random website could—having gained permission to spawn one video player—reuse that blessing 29 more times.

The browser will prevent auto-playing videos from spawning absent a user interaction. This is a feature that prevents pop-up hell. With this change, they failed to update the "make sure user is cool with this" code.

It's a regression, and will be fixed in an update or I eat my hat.

Again, I know this isn't some "error found on line 384 of vid.cpp" or whatever, but it's definitely not the way Apple wants this to work.

My desktop browsers won't do this, nor any other browser I've used in the past 10 years.

Re:Safari on iOS can overlap multiple full-screen videos by Maursault on Thursday June 16, 2022 @01:25PM (#31768636)
Design choices, that's all.

mobile Safari is a little different than desktop browsers. It uses the same engine as desktop Safari, but I've always suspected the video player is not built-in to the browser, but instead a separate and discrete application. I suspect this because every other application appears to have an identical video player. Maybe they're all sharing code, but more likely the video player is system-available to any application. But running multiple instances of that video player on iOS is academic. Why you're not able to duplicate this in any of your desktop browsers in the last decade is anyone's guess.

Re:Safari on iOS can overlap multiple full-screen videos by SigmundA on Thursday June 16, 2022 @02:35PM (#31769405)
>Why you're not able to duplicate this in any of your desktop browsers in the last decade is anyone's guess.

Because it's a bug not an intentional design choice. If you can provide a legitimate use case for being able to open 30 overlapping fullscreen videos from a single user click on a web site then you might have a some sort of argument.

This doesn't work on desktop Safari thankfully, if it did you could make some argument they are sharing code and trying to make iOS more like a desktop OS with multitasking, but no again there is no reason to do this on any OS other than to crash users browsers.

Re:Safari on iOS can overlap multiple full-screen videos by Maursault on Thursday June 16, 2022 @10:01PM (#31773303)
First of all, there is no use case for this very specific implementation of multitasking, fullscreen and overlapping windows. Second of all, the OP created and invented this. Though OP claims this behavior was innocently stumbled upon, it is clear, upon discovery of the behavior, the OP intentionally produced this behavior with their own webpage.

There is no error here. The code works precisely as intended, thus, this is not a bug, because bugs are errors in code that breaks the program's execution. That is not happening! The program still works and keeps on working until OP makes mobile Safari crash by intentionally eating up all the memory.

A software bug is an error, flaw or fault in the design, development, or operation of computer software that causes it to produce an incorrect or unexpected result, or to behave in unintended ways.[1]

Please continue to review the first 6 words of the definition until it sinks in that a bug is an error in the code, and a bug is not a quirk of interface design that you don't care for. If there is no flaw in the code, then there is no bug.

What OP and you and everyone else that apparently doesn't understand what a bug is are complaining about is this particular facet of mobile Safari's interface design. So if there is a problem here, it is not a flaw in the program code. It is a weird behavior that occurs when and only when the user decides to make their browser do weird things by creating a webpage to intentionally cause it. It sounds pretty darn unlikely to be repeated by anyone, and afaict, no one seems to have duplicated the behavior and reported back. But this is beside the point because the code is executing precisely as expected, and the program or system is not crashing because of this behavior, if it is crashing at all.

Again, this is not a bug. It is an entirely different animal.

[1] https://en.wikipedia.org/wiki/Software_bug

Re:Safari on iOS can overlap multiple full-screen videos by SigmundA on Friday June 17, 2022 @08:07AM (#31776927)
>Please continue to review the first 6 words of the definition until it sinks in that a bug is an error in the code, and a bug is not a quirk of interface design that you don't care for. If there is no flaw in the code, then there is no bug.

A software bug is an error, flaw or fault in the design, development, or operation of computer software that causes it to produce an incorrect or unexpected result, or to behave in unintended ways.

This behavior is a fault in the design of the browser code handling full screen video playback based on a user click, it produces an incorrect and unexpected result that can lead to breaking the programs execution (Safari crash).

You are doing some serious mental gymnastics over a single word "bug" that everyone else seems fine with. You still have not provided a legitimate use case for this behavior that would explain how this is expected and correct behavior as seen by the designers.

Re:Safari on iOS can overlap multiple full-screen videos by saagarjha on Thursday June 16, 2022 @05:28PM (#31771198)
> I've always suspected the video player is not built-in to the browser, but instead a separate and discrete application. I suspect this because every other application appears to have an identical video player. Maybe they're all sharing code, but more likely the video player is system-available to any application.

It’s provided in AVFoundation

Re:Safari on iOS can overlap multiple full-screen videos by bentcorner on Thursday June 16, 2022 @02:31PM (#31769370)
> It may not be intentional design, but my point is that this is not a bug, by the definition of what a bug is. There is no actual error here. The code is operating as expected. There may be issues with the interface design, but there also very well may not be.

Is this a useful distinction? The user expects something, the designer expects something different. Just the other day I read about Jeep's Monostable Shifter (https://www.youtube.com/watch?v=jD1-aQSO5Hg) and how it was attributed to people getting hurt or dying. It's operating exactly as designed and intended but was still recalled.

Re:Safari on iOS can overlap multiple full-screen videos by SigmundA on Thursday June 16, 2022 @12:57PM (#31768346)
>Yes, he absolutely is, and the proof is

No they aren't there is a button that the user clicks that runs code to play multiple overlapping videos. This serves no conceivable purpose and can cause the browser to crash, it is a bug.

The reason it works is the code is run from a user action, the problem is after the first video play the browser should no longer consider the subsequent plays a user action, or it should only play the last video and cleanup the now overlapped previous video.

Re:Safari on iOS can overlap multiple full-screen videos by Maursault on Thursday June 16, 2022 @01:06PM (#31768442)
You're talking about design choices, not errors or software bugs. You have a design preference that more than one fullscreen video should not be permitted. But this is entirely an arbitrary preference. There is absolutely nothing inherently wrong (ethically or design-wise) with multiple overlapping fullscreen videos, though the OP is describing a very particular case that is strange, which is having multiple instances of the same video playing fullscreen. It's still not a bug. This is interface design.
Re:Safari on iOS can overlap multiple full-screen videos by function_seven on Thursday June 16, 2022 @02:03PM (#31769103)
> You have a design preference that more than one fullscreen video should not be permitted.

I think this is where you and I are talking past each other. I'm not saying that multiple videos shouldn't be allowed. That's not the problem here.

The problem is that Safari has a mechanism to ensure that the user wants a video to play. That mechanism looks for some UI action on the user's part before it will allow a site to launch the video player. With this new multiple-video feature, that mechanism is now broken. It'll say, "Hey you want to play this video? Yeah, ok, I will allow it, and any other video the site wants to spam you with now."

That italicized part is the bug. It shouldn't assume the UI action applies to an arbitrary number of separate videos.

The video player is fine. That's the design choice. The Safari code not accounting for that is the bug.

Re:Safari on iOS can overlap multiple full-screen videos by Maursault on Thursday June 16, 2022 @10:11PM (#31773380)
You're still talking about interface design and not an error in the actual code. You're talking about how the user is interacting with the software, and/or how a website developer writes up his crappy site. The software itself isn't broken. But the interaction between user and client and server is getting under your skin and you're insisting it is a bug... when it simply is not a bug.

"Every time a try to click this link, my browser crashes!" <--- that sounds like a bug.

"I'm able to create a webpage that exploits a user interaction to create weird behavior" <---- not a bug! if a problem exists it is within the realm of User Interface Design and not software design or anything within the code itself. The design choices may cause a need to rework the code, but that doesn't make a bug magically appear in the code.

Re:Safari on iOS can overlap multiple full-screen videos by function_seven on Thursday June 16, 2022 @10:27PM (#31773487)
I’m just going to quote myself, upthread:

> Okay, so it may not be a software bug at all, but I'm gonna move these goalposts and insist this is a product design bug, or something.

Re:Safari on iOS can overlap multiple full-screen videos by jaywalk on Thursday June 16, 2022 @12:47PM (#31768198)
The person who created the web page is the user? I think you've got that backwards.
Re:Safari on iOS can overlap multiple full-screen videos by stonemetal12 on Thursday June 16, 2022 @04:43PM (#31770752)
He found a bug and made a proof of concept webpage to demonstrate it. So when he talks about it he is both the user and the author of the web page. In general You wouldn't expect them to be the same person.