"C'mon, I Want Lolcats" or "how to abuse JS in EPUB3"

[AlPe]

Just a minimal PoC of how one can "abuse" JS embedded in an EPUB3 ebook to show content not easily detectably by just looking at the files inside the EPUB3 (ZIP) container.

In particular, if loaded in a JS-enabled EPUB3 reading system (e.g.: iBooks, Readium, Kobo iOS app), the user will be presented with a "non-existing" image...

http://www.albertopettarin.it/downloads/lolcats.epub

Enjoy (and/or discuss)

EDIT: a page discussing the above PoC is here: http://www.albertopettarin.it/lolcats.html

[Nate the great]

LOL. That is funny.

[PoP]

ROTFL at the mutant cat. Ingenious.

Also, I discovered that Calibre reader is JS-enabled.

[JSWolf]

Then it's time for JS to be removed from ePub3 before we get more of this sort of nonsense.

[AlPe]

Sandboxing + limited local storage + no network access (the latter two might be at user's will) should suffice as being a deterrent against "exploitation".

JS brings some benefits (manipulating the DOM might be used for very legitimate and worthy goals) and it fills some implementation gaps (like my Media Overlay emulator JS for reflowable EPUB3 ebooks in iBooks).

I think that the "JS rage" (no offence intended) should be directed towards other targets, like buggy, lacking, or non coherent implentation of (EPUB) standards.

[JSWolf]

We don't need or even want JS, audio, video, and all that other garbage the standards committee pub into ePub3 to make it less about eBooks and more about flashy stuff.

[DaleDe]

Originally Posted by JSWolf

We don't need or even want JS, audio, video, and all that other garbage the standards committee pub into ePub3 to make it less about eBooks and more about flashy stuff.

Actually it seems the major thrust is for children's books. That is what this is all about.

Dale

[AlPe]

I would distinguish between audio/video and JavaScript, since the latter poses some security issues. With respect to the former, not everyone will need or use them, I agree, but there are books that are quite amenable to be narrated, or for which video material might be helpful and I do not see a point for barring that possibility.

[Kirtai]

Audio does have precedent too, in the form of DAISY synchronised audio/prose books.

[Turtle91]

Wolfie's "we" is obviously the royal "We"...not intended to imply that we all agree with that statement! lol

[JSWolf]

So who here actually, wants JS, audio, video and other worthless things like that in your eBooks? I don't and I've read a lot saying no way.

ePub3 could have been adopted already if the standards committee had not added all this extra junk to it.

[AlPe]

My (own) company is producing EPUB 3 Audio-eBooks for an Italian audiobook publisher. More than ~1K users bought them already, and I think that having text+audio (not TTS, but "real" human narration) is a pretty interesting experience.

But, of course, someone might prefer just reading the text. Or just listening to the narration.

BTW, you can download a free EPUB3 Audio-eBook of "The Curious Case of Benjamin Button" by F. Scott Fitzgerald here:

http://www.smuuks.it/index.php/en/pr...enjamin-button

[Soup~]

Originally Posted by JSWolf

So who here actually, wants JS, audio, video and other worthless things like that in your eBooks? I don't and I've read a lot saying no way.

ePub3 could have been adopted already if the standards committee had not added all this extra junk to it.

Well, universities that are looking to distribute their textbooks (homegrown) to students as ebooks, at least.

The department at the institution I work at has been slowly shifting away from traditional models of textbook publishing/distribution. A few of our textbooks are in ePub and Mobi format and have embedded video files that explain concepts at different parts of the book. I think including videos and other media is something that students appreciate; I was a student not too long ago, and I know I would have appreciated it.

Our institution considered using iBooks Author to create/distribute the textbooks because of its video/audio support (among other features), but eventually opted for just creating ePub to make the publications more accessible to a wider range of students. I'm pretty sure that, if not for ePub also supporting audio/video, however, we would've ended up going with iBooks Author.

[JSWolf]

By going for ePub3, your institution has made the textbook less accessible to students because there are hardly any programs/apps to handle ePub3.

[Morganucopia]

Originally Posted by Soup~

Our institution considered using iBooks Author to create/distribute the textbooks because of its video/audio support (among other features), but eventually opted for just creating ePub to make the publications more accessible to a wider range of students. I'm pretty sure that, if not for ePub also supporting audio/video, however, we would've ended up going with iBooks Author.

An excellent, fully standards-compliant, free EPUB3 reader is Readium and it's available as an extension to Google Chrome. Perhaps your students can use that to read their textbooks. Plus, there's always Calibre.