3 ms·

That's a very much talked about subject in the standardization groups. They've concluded that WebRTC doesn't add any additional privacy or security exposure th

That's a very much talked about subject in the standardization groups. They've concluded that WebRTC doesn't add any additional privacy or security exposure than what exists in the browsers previous to it. Can you please explain more why you think there are copyright implications?

nolok 10y ago
I'm not sure about the US, but in the EU and in particular in my country of France, anti-piracy lawsuits have seen a very clearly drawn line between a mere downloader, and an uploader. That's what lead emule and bittorrent to be "dangerous" legally while direct downloading (newsgroup, rapidshare, ...) and streaming almost never led to conviction (even symbolic). That the user didn't realize his bittorrent was re-uploading content to others didn't matter. So, if I visit a website to get, say, direct copyrighted content (let's say photo, comics, music, whatever) and that website uses webrtc to make me reshare it to other users, my legal status just went from a almost never convicted downloader to a very much punished (even though it stayed symbolic, it was still a legal loss) uploader.
- shacharz 10y ago
  What's different in the CDN use-case is that the content that reached a 3rd user through the uploading user would've reached the 3rd anyway, just from the original server.
  - nolok 10y ago
    Yeah but from the point of view of the (unexpecting) uploader that doesn't change anything. If user A wasn't uploading, user B would still get the files from other peers on the torrent, doesn't change the fact A was sharing and actively uploading the file. Not trying to throw a wrench in your game, but I think this is something you guys need to have a look into because you're turning unsuspecting users into uploaders of content they have no control over, without noticing it, when it has been proven to cause them legal harm.
    - shacharz 10y ago
      We're definitely looking into that, AFAIK for now, is that as long as the content is legal there's no problem with uploading it.
  - deleted 10y ago
    [deleted]
TekMol 10y ago
Privacy: The users IP and more is sent to other users of the website. Copyright: Content gets distributed by the users computer without his consent. He cannot know if he has been turned into part of a piracy network.
- mrbar42 10y ago
  That's not true because you send or receive data from other peers only if you are already watching a video. In other words - p2p is used only in places where the data would have gotten from the server anyways (e.g. p2p didn't add any new users to the equation)
  - nolok 10y ago
    I'm not sure what's your point. You A are getting content from server S. B is getting the same content from server S. With this CDN, what changes is that A is now sending content to B. Content that may be illegal. The fact that would mean A was accessing illegal content doesn't change the fact that this CDN moves him from a downloader to an uploader, without his content nor telling him, something that has legal precedent for leading to convictions in europe.
detaro 10y ago
> They've concluded that WebRTC doesn't add any additional privacy or security exposure than what exists in the browsers previous to it. Even the WebRTC standard talks quite a bit about it in the Privacy and Security Considerations section, some quotes: Revealing IP addresses can leak location and means of connection; this can be sensitive. Depending on the network environment, it can also increase the fingerprinting surface and create persistent cross-origin state that cannot easily be cleared by the user. [...] These choices can for instance be made by the application based on whether the user has indicated consent to start a media connection with the other party. https://w3c.github.io/webrtc-pc/#privacy-and-security-considerations https://w3c.github.io/webrtc-pc/#privacy-and-security-consid... On standards without additional exposure, this section normally says so and is otherwise empty. Exposing other visitors IPs is a pretty massive leak (at least some jurisdictions consider them PII, with the consequences to match), presenting that as "no additional privacy exposure" is just negligent (or more likely intentionally misleading).

nolok 10y ago

I'm not sure about the US, but in the EU and in particular in my country of France, anti-piracy lawsuits have seen a very clearly drawn line between a mere downloader, and an uploader. That's what lead emule and bittorrent to be "dangerous" legally while direct downloading (newsgroup, rapidshare, ...) and streaming almost never led to conviction (even symbolic). That the user didn't realize his bittorrent was re-uploading content to others didn't matter. So, if I visit a website to get, say, direct copyrighted content (let's say photo, comics, music, whatever) and that website uses webrtc to make me reshare it to other users, my legal status just went from a almost never convicted downloader to a very much punished (even though it stayed symbolic, it was still a legal loss) uploader.

shacharz 10y ago
What's different in the CDN use-case is that the content that reached a 3rd user through the uploading user would've reached the 3rd anyway, just from the original server.
- nolok 10y ago
  Yeah but from the point of view of the (unexpecting) uploader that doesn't change anything. If user A wasn't uploading, user B would still get the files from other peers on the torrent, doesn't change the fact A was sharing and actively uploading the file. Not trying to throw a wrench in your game, but I think this is something you guys need to have a look into because you're turning unsuspecting users into uploaders of content they have no control over, without noticing it, when it has been proven to cause them legal harm.
  - shacharz 10y ago
    We're definitely looking into that, AFAIK for now, is that as long as the content is legal there's no problem with uploading it.
- deleted 10y ago
  [deleted]

TekMol 10y ago

Privacy: The users IP and more is sent to other users of the website. Copyright: Content gets distributed by the users computer without his consent. He cannot know if he has been turned into part of a piracy network.

mrbar42 10y ago
That's not true because you send or receive data from other peers only if you are already watching a video. In other words - p2p is used only in places where the data would have gotten from the server anyways (e.g. p2p didn't add any new users to the equation)
- nolok 10y ago
  I'm not sure what's your point. You A are getting content from server S. B is getting the same content from server S. With this CDN, what changes is that A is now sending content to B. Content that may be illegal. The fact that would mean A was accessing illegal content doesn't change the fact that this CDN moves him from a downloader to an uploader, without his content nor telling him, something that has legal precedent for leading to convictions in europe.

detaro 10y ago

> They've concluded that WebRTC doesn't add any additional privacy or security exposure than what exists in the browsers previous to it. Even the WebRTC standard talks quite a bit about it in the Privacy and Security Considerations section, some quotes: Revealing IP addresses can leak location and means of connection; this can be sensitive. Depending on the network environment, it can also increase the fingerprinting surface and create persistent cross-origin state that cannot easily be cleared by the user. [...] These choices can for instance be made by the application based on whether the user has indicated consent to start a media connection with the other party. https://w3c.github.io/webrtc-pc/#privacy-and-security-considerations https://w3c.github.io/webrtc-pc/#privacy-and-security-consid... On standards without additional exposure, this section normally says so and is otherwise empty. Exposing other visitors IPs is a pretty massive leak (at least some jurisdictions consider them PII, with the consequences to match), presenting that as "no additional privacy exposure" is just negligent (or more likely intentionally misleading).