Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Open source JavaScript library to record and replay the web

rrweb.io

Post reply on HN
Print view View original

21–30 of 56 posts

Re: Show HN: Open source JavaScript library to record and replay the web

#21

Post by hjek »

marksomnian wrote: post #9

Looks really cool, but I find myself thinking about the privacy implications of using this, especially by default. Even if the user gives consent, it still implies recording every single mouse movement and keystroke on the site. Has this been normalised? Is this the new default? Food for thought.

RMS has been writing about the issue of non-free session recording scripts in The JavaScript Trap[0]:

> In addition to being nonfree, many of these programs are malware because they snoop on the user. Even nastier, some sites use services which record all the user's actions while looking at the page.[1] The services supposedly “redact” the recordings to exclude some sensitive data that the web site shouldn't get. But even if that works reliably, the whole purpose of these services is to give the web site other personal data that it shouldn't get.

[0]: https://www.gnu.org/philosophy/javascript-trap.html

[1]: https://freedom-to-tinker.com/2017/11/15/no-boundaries-exfil...

Re: Show HN: Open source JavaScript library to record and replay the web

#23

Post by SquareWheel »

hjek wrote: post #21
marksomnian wrote: post #9

Looks really cool, but I find myself thinking about the privacy implications of using this, especially by default. Even if the user gives consent, it still implies recording every single mouse movement and keystroke on the site. Has this been normalised? Is this the new default? Food for thought.

RMS has been writing about the issue of non-free session recording scripts in The JavaScript Trap[0]: > In addition to being nonfree, many of these programs are malware because they snoop on the user. Even nastier, some sites use services which record all the user's actions while looking at the page.[1] The services supposedly “redact” the recordings to exclude some sensitive data that the web site shouldn't get. But…

I agree with the privacy concern, but calling analytics software "malware" is too extreme. It isn't mining for bitcoins on your hardware, or encrypting your documents to extort you.

Always using the most extreme terms just makes it easier to dismiss such views outright.

Re: Show HN: Open source JavaScript library to record and replay the web

#24

Post by eastendguy »

marksomnian wrote: post #9

Looks really cool, but I find myself thinking about the privacy implications of using this, especially by default. Even if the user gives consent, it still implies recording every single mouse movement and keystroke on the site. Has this been normalised? Is this the new default? Food for thought.

I agree. So while the project is technically super-cool, I prefer a browser extension for privacy reasons. With an extension (that does not "phone home") all data is stored locally on my machine. And if needed, the open-source kantu tool offers a way to embedded recordings into (your) a website, too:

https://a9t9.com/kantu/demo/runweb

Inside your local team you can of course share the recording simply as JSON files, via github and other services.

Another advantage of using browser extensions like kantu, selenium ide and imacros is that they are more powerful by design, but that is another topic.

Re: Show HN: Open source JavaScript library to record and replay the web

#25

Post by palerdot »

marksomnian wrote: post #9

Looks really cool, but I find myself thinking about the privacy implications of using this, especially by default. Even if the user gives consent, it still implies recording every single mouse movement and keystroke on the site. Has this been normalised? Is this the new default? Food for thought.

I think, this should be considered as an easy to use library to do things that is anyway being done already, or anyone can do with some amount of work. Comparing this library to surveillance tool kind of distorts the idea of what this library is trying to achieve here.

Re: Show HN: Open source JavaScript library to record and replay the web

#26

Post by eddyparkinson »

yz-yu wrote: post #5

Hi, hackers, the author here. Since I've seen some people are talking about the open source idea and comparing rrweb to some commercial products, I'd like to share a blog post about the vision of rrweb. http://www.myriptide.com/rrweb-introduction/ Also, you will know about how rrweb works in this post.

A JSFiddle example would be handy. A record and replay example.

Re: Show HN: Open source JavaScript library to record and replay the web

#27

Post by hjek »

SquareWheel wrote: post #23
hjek wrote: post #21

Earlier quoted context omitted.

RMS has been writing about the issue of non-free session recording scripts in The JavaScript Trap[0]: > In addition to being nonfree, many of these programs are malware because they snoop on the user. Even nastier, some sites use services which record all the user's actions while looking at the page.[1] The services supposedly “redact” the recordings to exclude some sensitive data that the web site shouldn't get. But…

I agree with the privacy concern, but calling analytics software "malware" is too extreme. It isn't mining for bitcoins on your hardware, or encrypting your documents to extort you. Always using the most extreme terms just makes it easier to dismiss such views outright.

I think it depends on how the software is used.

A friend of mine got a suspicious tax returns email that had a link to a form asking for credit card information. Being careful and responsible, my friend of course asked me if the site looked legit before actually pressing 'submit'.

Of course it was a scam site, and using session recording, they could very well have gotten my friend's credit card details without per pressing 'submit'.

I think it's always the context that decides whether something is malware. Is a program that erases everything on your disk malware? Perhaps, but if it's a disk formatting tool and you asked it to do so, then it's not.

Re: Show HN: Open source JavaScript library to record and replay the web

#28

Post by SquareWheel »

hjek wrote: post #27
SquareWheel wrote: post #23

Earlier quoted context omitted.

I agree with the privacy concern, but calling analytics software "malware" is too extreme. It isn't mining for bitcoins on your hardware, or encrypting your documents to extort you. Always using the most extreme terms just makes it easier to dismiss such views outright.

I think it depends on how the software is used. A friend of mine got a suspicious tax returns email that had a link to a form asking for credit card information. Being careful and responsible, my friend of course asked me if the site looked legit before actually pressing 'submit'. Of course it was a scam site, and using session recording, they could very well have gotten my friend's credit card details without per pr…

Yes, that's a fair point and I agree with you on both examples.

Re: Show HN: Open source JavaScript library to record and replay the web

#30

Post by jagracey »

Great work yz-yu. Hope you've learned a lot- I've personally found the session replay space to be incredibly rewarding.

However, as a session replay industry competitor and a former security researcher for most industry players, I caution anyone thinking of using a side-project like this on production applications to proceed slowly with care.

Security and Privacy are extremely hard to get right here. The tricky thing about session replay analytics is that attackers have a huge attack vector, and compromise means gaining a treasure trove of all user data. The nature of replay is in a way a form of XSS. Modern security features help (like CSPs, iframe Sandbox attribute) but browser changes can cause issues.

Some of the challenges: - CSPs can often be bypassed using Google API libraries, , - Blacklisting tags can often be bypassed with an XML namespace - CSS based data or password exfiltration. - Clickjacking, "data:" urls etc. - Could you imagine a web request proxy server deploying Service Workers? - postMsg() from further nested frames

Substantial work goes into sandboxing replay environments and limiting PII. Defense in depth is particularly important here. Enterprise level research, auditing, monitoring and care should be taken seriously.

Post reply on HN