Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Open source JavaScript library to record and replay the web

rrweb.io

Post reply on HN
Print view View original

41–50 of 56 posts

Re: Show HN: Open source JavaScript library to record and replay the web

#41

Post by jagracey »

tmikaeld wrote: post #40
jagracey wrote: post #30

Great work yz-yu. Hope you've learned a lot- I've personally found the session replay space to be incredibly rewarding. However, as a session replay industry competitor and a former security researcher for most industry players, I caution anyone thinking of using a side-project like this on production applications to proceed slowly with care. Security and Privacy are extremely hard to get right here. The tricky thing…

I would love to read more about these kind of security issues, maybe you have a blog about this? Or some great resources maybe? I know of the obvious ones like OWASP; but that only scratches the surface.

I got one about bypassing GitHub's authentication using Unicode on the company blog: https://blog.getwisdom.io/hacking-github/

I've wanted to write a deep dive on JS defense for a while now. Lots of cool stuff learned I'd love to share- maybe in the next few weeks.

Re: Show HN: Open source JavaScript library to record and replay the web

#42

Post by dceddia »

hjek wrote: post #27
SquareWheel wrote: post #23

Earlier quoted context omitted.

I agree with the privacy concern, but calling analytics software "malware" is too extreme. It isn't mining for bitcoins on your hardware, or encrypting your documents to extort you. Always using the most extreme terms just makes it easier to dismiss such views outright.

I think it depends on how the software is used. A friend of mine got a suspicious tax returns email that had a link to a form asking for credit card information. Being careful and responsible, my friend of course asked me if the site looked legit before actually pressing 'submit'. Of course it was a scam site, and using session recording, they could very well have gotten my friend's credit card details without per pr…

It's a good example, and something I often wonder about when I'm filling out a survey and give up part-way -- did they save the questions I had already answered?

FWIW you probably wouldn't need something as powerful or blunt as session recording to pull this off, though. You'd only need to listen for keystrokes on the relevant input (with document.addEventListener or similar), and send them to the server as they're typed. Same with partially-filled surveys. IIRC Facebook got in some heat a while ago for sending the partially-typed messages up to the server and to the other chat participant.

Re: Show HN: Open source JavaScript library to record and replay the web

#43

Post by dang »

yz-yu wrote: post #34
jagracey wrote: post #30

Great work yz-yu. Hope you've learned a lot- I've personally found the session replay space to be incredibly rewarding. However, as a session replay industry competitor and a former security researcher for most industry players, I caution anyone thinking of using a side-project like this on production applications to proceed slowly with care. Security and Privacy are extremely hard to get right here. The tricky thing…

Definitely learned a lot and enjoy the process and thanks for your really important suggestions. Quote from my introduction blog post: === Today we already have some commercial session replay products like Logrocket, Fullstory, etc. If you are just looking for a ready-to-use tool and would like to pay for its service, I would recommend you to use the above products, because they have well-tested backend services that…

(Sorry your account was rate-limited! New accounts are subject to that restriction but it's definitely not intended for cases like this. I've marked your account legit so it won't happen again.)

Re: Show HN: Open source JavaScript library to record and replay the web

#44

Post by pault »

yz-yu wrote: post #5

Hi, hackers, the author here. Since I've seen some people are talking about the open source idea and comparing rrweb to some commercial products, I'd like to share a blog post about the vision of rrweb. http://www.myriptide.com/rrweb-introduction/ Also, you will know about how rrweb works in this post.

How does the replay work? Do you have to embed the player in the site being recorded or can you replay a recording on another page, like an analytics dashboard? Does it capture styles with the DOM snapshots?

Re: Show HN: Open source JavaScript library to record and replay the web

#46

Post by echelon »

You should offer a commercial and open source version. The commercial service could provide a few extra features at a modest price point, but support development of the open source platform. Perhaps it could pay your bills and be a cheaper alternative to the existing expensive commercial offerings. I could see you taking a big bite out of their market if you keep it up.

Re: Show HN: Open source JavaScript library to record and replay the web

#47

Post by chrisweekly »

jagracey wrote: post #41
tmikaeld wrote: post #40

Earlier quoted context omitted.

I would love to read more about these kind of security issues, maybe you have a blog about this? Or some great resources maybe? I know of the obvious ones like OWASP; but that only scratches the surface.

I got one about bypassing GitHub's authentication using Unicode on the company blog: https://blog.getwisdom.io/hacking-github/ I've wanted to write a deep dive on JS defense for a while now. Lots of cool stuff learned I'd love to share- maybe in the next few weeks.

> I've wanted to write a deep dive on JS defense for a while now. Lots of cool stuff learned I'd love to share- maybe in the next few weeks.

Please do! :)

Re: Show HN: Open source JavaScript library to record and replay the web

#48

Post by sbr464 »

Regarding security & privacy of products like these, I think it would be interesting to not capture any data not included within the app's codebase by default, instead of relying on any kind of redaction steps.

For example,

A table and interacting with a table, the cells would just be filler elements. Form field data just wouldn't be captured, contents unique to any record on a page would be filled with sample data.

That way you get to see how someone interacts with a page, but not any context/personal information.

I think relying on sensible defaults or redacting data is a lost cause and puts the trust/responsibility in the wrong hands. Some companies may care about redaction while others don't prioritize it.

Re: Show HN: Open source JavaScript library to record and replay the web

#49

Post by insomniacity »

Walkman wrote: post #45

This is NOT Open Source in a way you think it is yet, because the repo doesn't have a LICENSE attached to it, so the owner own every right and you are not allowed to sell it or do whatever you want with it.

Correct - does fair use cover even running software without a license?

This wouldn't pass the first hurdle at my dayjob...

Re: Show HN: Open source JavaScript library to record and replay the web

#50

Post by insomniacity »

yz-yu wrote: post #17
sauravt wrote: post #15

Earlier quoted context omitted.

May I know what open source license is the project under?

MIT https://github.com/rrweb-io/rrweb/blob/master/package.json#L...

I'm not a lawyer, but three characters in package.json isn't sufficient. You need to include the license text - eg https://github.com/nodejs/node/blob/master/LICENSE.
Post reply on HN