I did not. I already wasted enough time and energy in the past reporting a security vulnerability in Safari's CSP to know that reporting it is not worth it.
I couldn't help notice you've exploited your observation in order to promote your blog. There seems to be an awful lot of Apple shaming for self-promotion and entitlement to do so without reciprocating the free attention by taking 5 minutes of your precious time to file a bug report. And I, for one, love how you don't even provide any version information, no iOS version details, no mobile Safari version details. Nothing. Maybe your bug reports are discarded because you fail to provide any salient details.
But I think you're absolutely right. A bug report will serve no purpose, because this is definitely not a bug, i.e. not a flaw in code that causes the software to crash or explode. It is instead leveraging a quirk of interface design in order to garner attention for an otherwise unremarkable blog.
And I'd agree, except that this behavior is an advertised feature of the of the system, iow, if you open multiple fullscreen videos, you should expect to see what is seen as opposed to Safari crashing or the system crashing.
Hmm, is opening a fullscreen video considered opening a new application, or is it considered a single application (the browser) displaying different content? I thought it was the second case, so multitasking I don't think applies. Same for desktop chrome, when it shows a fullscreen video, that's not a new application, just the browser displaying content in a new way.
For picture in picture mode, I don't think multiple fullscreen videos should be a valid configuration of picture in picture.
At this point I’m not even sure if the post is talking about the same thing you’re mentioning.
It’s not about “global state” in a sense of state available across the app, it’s specifically about not using the JS engine’s global object (https://developer.mozilla.org/en-US/docs/Glossary/Global_obj...) to avoid common pitfalls.
2. Inspect all of them with the technique used in the article and update the inspection logic so that it checks does a deep check of the value "HelloWorld123" as well (the value can be accessed here: https://gist.github.com/mmazzarolo/2b325f3af2bc83f56d3c921ff...)
Hey! Was this a response to another comment? In the post I'm explaining why it's happening (and it's just purposely bad code to show a global instantiation example)