Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“We are considering adding an extension to restrict the use of WebRTC”

bugzilla.mozilla.org

Post reply on HN
Print view View original

121–130 of 159 posts

Re: “We are considering adding an extension to restrict the use of WebRTC”

#121

Post by scott_karana »

return0 wrote: post #118
jnbiche wrote: post #9

I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being…

> I don't understand why a peer-to-peer network connection is different from Ajax Ajax is one-way

Hardly. One direction's "packet" size is just limited by URL encoding/length restrictions. :)

Re: “We are considering adding an extension to restrict the use of WebRTC”

#122

Post by MichaelGG »

jnbiche wrote: post #74
lgrapenthin wrote: post #69

Earlier quoted context omitted.

I'd assume that this is a rather rare usecase in the world wide web, so why is it not disabled by default?

No, it's not rare. This is something all peer-to-peer networks running over IPv4 must do. WebRTC video, audio, or data wouldn't work without this.

Things worked fine before ICE. In fact, stuff like Bittorrent still works fine. If they were truly concerned with connectivity, they'd use upnp. But since that wasn't a standard from a friendly body, they added this ICE hack to try to make things work.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#124

Post by GrinningFool »

madeofpalk wrote: post #56
kuschku wrote: post #23

Earlier quoted context omitted.

The issue is that, for example, the New York Times actually used WebRTC to gather data for exactly that purpose. https://webrtchacks.com/dear-ny-times/

Although NYT shouldn't get off scott-free, I think it's worth pointing out that they probably had very little to do with this and more than likely had no idea about it. The WebRTC 'tracking' was from a script from an ad network[1] used by at least Ars Technica and The Washington Post. As someone who works on sites implementing display advertising using these sorts of networks, I have nothing but contempt for the deve…

> I have nothing but contempt for the developers that are writing these JS

I have nothing but contempt for the companies that accept advertising from untrusted third parties who can offer no assurance as to the security or even the content of the code their platforms allow to run on client browsers. That doesn't even get into the tracking that the advertising platforms themselves have access to.

Host your advertising yourself and I let it through with very little exception. If it comes from another server, it's blocked.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#125

Post by csense »

drzaiusapelord wrote: post #95
userbinator wrote: post #78

Does anyone else feel that there's something terribly odd going on when restricting something needs to be an extension ? IMHO it should be a configuration option, per-site, and off by default. WebRTC also isn't the only thing that applies to.

The recent moves to turn the browser into its own OS are worrying. The problem I see is that no one seems to care. Its full steam ahead and its only later do we realize that these new feature and standards are trivial to abuse. I really wish there was some kind of web mission statement on where browsers are going instead of this kitchen sink approach. I have no idea what the W3C is thinking. I don't think even the W3…

> no one seems to care

Article about browser feature creep, currently on frontpage: https://news.ycombinator.com/item?id=9961613

People do care about this stuff. Maybe not enough people, and maybe not the right people to do anything about it. But there are people right here on HN who do care about this stuff.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#126

Post by comex »

MichaelGG wrote: post #122
jnbiche wrote: post #74

Earlier quoted context omitted.

No, it's not rare. This is something all peer-to-peer networks running over IPv4 must do. WebRTC video, audio, or data wouldn't work without this.

Things worked fine before ICE. In fact, stuff like Bittorrent still works fine. If they were truly concerned with connectivity, they'd use upnp. But since that wasn't a standard from a friendly body, they added this ICE hack to try to make things work.

As someone who's implemented a P2P feature for an application: UPnP works great... if you have a router that supports it. Many in the wild do not. If yours doesn't, you have to manually port forward, which, even disregarding the newbie user issue, isn't possible if you're connected to someone else's network. Otherwise, as I assume you know, you can only initiate connections, not receive them, which means you can't talk to anyone with the same limitation - which might not be fatal to your BitTorrent download, albeit limiting your speed, but kinda sucks in something like a one-on-one video chat or game session.

AFAIK, all major video chat applications use some variant of STUN, on which ICE is based, along with some proxying mechanism for users who truly can't connect directly to each other, which corresponds to the rest of ICE.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#127

Post by ef4 »

pjc50 wrote: post #61
jnbiche wrote: post #9

I don't understand why a peer-to-peer network connection is different from Ajax. Browsers don't require user approval for 3rd-party XMLHttpRequest connections. WebSockets are even more permissive. Why is WebRTC being singled out here? If I were a conspiracy-minded person (I'm not), I'd have to wonder if this was some kind of corporate-driven attempt to suppress peer-to-peer networks. In fact, I do think this is being…

a peer-to-peer Twitter would not be impossible One of the key features of twitter, the global reach of hashtags, would be impossible. Twitter relies very heavily on being centralised. Anyone claiming to build a decentralised twitter needs a very careful numbers-based argument as to what the bandwidth consumption of being a popular user or hashtag might be.

If a million people suddenly want to participate in a single hashtag, you necessarily also have a million devices able to contribute to the distribution of the content. It's far from intractable. It's bittorrent for tweets.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#128

Post by manigandham »

GrinningFool wrote: post #124
madeofpalk wrote: post #56

Earlier quoted context omitted.

Although NYT shouldn't get off scott-free, I think it's worth pointing out that they probably had very little to do with this and more than likely had no idea about it. The WebRTC 'tracking' was from a script from an ad network[1] used by at least Ars Technica and The Washington Post. As someone who works on sites implementing display advertising using these sorts of networks, I have nothing but contempt for the deve…

> I have nothing but contempt for the developers that are writing these JS I have nothing but contempt for the companies that accept advertising from untrusted third parties who can offer no assurance as to the security or even the content of the code their platforms allow to run on client browsers. That doesn't even get into the tracking that the advertising platforms themselves have access to. Host your advertising…

As someone who works on ad networks, I agree. While they put a lot of work into the backend stack, the frontend is usually written in the worst possible way.

Tons of document.write, loading dozens of more tags, everyone has their own copy of jquery, etc.

The industry just doesn't have any technical leadership in the governing bodies so there's no accountability or any expertise to check that the networks are built right.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#129

Post by drzaiusapelord »

csense wrote: post #125
drzaiusapelord wrote: post #95

Earlier quoted context omitted.

The recent moves to turn the browser into its own OS are worrying. The problem I see is that no one seems to care. Its full steam ahead and its only later do we realize that these new feature and standards are trivial to abuse. I really wish there was some kind of web mission statement on where browsers are going instead of this kitchen sink approach. I have no idea what the W3C is thinking. I don't think even the W3…

> no one seems to care Article about browser feature creep, currently on frontpage: https://news.ycombinator.com/item?id=9961613 People do care about this stuff. Maybe not enough people, and maybe not the right people to do anything about it. But there are people right here on HN who do care about this stuff.

I was pleasantly surprised to see that article on the front page. It wasn't up when I posted my comment. I do hope this becomes a major issue.

Re: “We are considering adding an extension to restrict the use of WebRTC”

#130

Post by manigandham »

madeofpalk wrote: post #56
kuschku wrote: post #23

Earlier quoted context omitted.

The issue is that, for example, the New York Times actually used WebRTC to gather data for exactly that purpose. https://webrtchacks.com/dear-ny-times/

Although NYT shouldn't get off scott-free, I think it's worth pointing out that they probably had very little to do with this and more than likely had no idea about it. The WebRTC 'tracking' was from a script from an ad network[1] used by at least Ars Technica and The Washington Post. As someone who works on sites implementing display advertising using these sorts of networks, I have nothing but contempt for the deve…

They aren't written for the user experience, they're written by low-level techs usually (because the JS part isn't as "cool/exciting/important" as the backend part) to just get the ad on the page somehow.

It's probably the worst of the worst in JS engineering sadly.

Post reply on HN