10 ms·

WebRTC is almost here, and it will change the web

146 points by denismars 14y ago

AndrewDucker 14y ago
At the moment, NAT means that lots of connections have to go through a central server, at least to set up the connection. With IPv6, that need should vanish (providing you aren't firewalled by your router). The two things combined should remove a lot of middlemen.
- dustismo 14y ago
  Exactly. Almost everyone is behind a router so there is no way this is going to be as useful as stated in the article.
  - arendn 14y ago
    P2P firewall traversal is pretty common these days. Checkout STUN/ICE/TURN.
  - drivebyacct2 14y ago
    Every example I'm aware of for WebRTC right now uses STUN. It's part of ROAP and it's possible in JSEP (and easier, with ROAP-via-JSEP library). Nah, everyone is just claiming this to be awesome and just happened to forget about NAT routers....
  - dustismo 14y ago
    I stand corrected :). I was just reading up on STUN, it is a very interesting solution.
- rfolstad 14y ago
  Actually check out the webrtc talk from googleio. They use the NAT device's IP to get around this. http://www.youtube.com/watch?v=E8C8ouiXHHk http://www.youtube.com/watch?v=E8C8ouiXHHk
- drivebyacct2 14y ago
  IPv6 does not mean the end of NAT, and WebRTC ROAP or JSEP already have ICE style STUN/TURN traversal mechanisms. (4 months ago I had a demo working using ROAP and STUN before they switched to JSEP. I'm literally in the middle of upgrading it to the new API.) The "setup" for the connections in the central server is trivial with a tiny websockets server and a few messages shuttled back and forth.
  - zanny 14y ago
    Holy acroynm city batman.
  - thebigshane 14y ago
    For reference for others: NAT (Network Address Traversal): exposing only your router's ip address and hiding your own to outside traffic [https://en.wikipedia.org/wiki/Network_address_translation https://en.wikipedia.org/wiki/Network_address_translation] ROAP (RTCWeb Offer/Answer Protocol): main voice protocol [https://en.wikipedia.org/wiki/RTCWeb_Offer/Answer_Protocol https://en.wikipedia.org/wiki/RTCWeb_Offer/Answer_Protocol] JSEP (JavaScript Session Establishment Protocol): protocol for setting up P2P connection [https://en.wikipedia.org/wiki/JavaScript_Session_Establishment_Protocol https://en.wikipedia.org/wiki/JavaScript_Session_Establishme...] Following are all technologies for punching through NAT... ICE (Interactive Connectivity Establishment): [https://en.wikipedia.org/wiki/Interactive_Connectivity_Establishment https://en.wikipedia.org/wiki/Interactive_Connectivity_Estab...] STUN (Session Traversal Utilities for NAT): [https://en.wikipedia.org/wiki/STUN https://en.wikipedia.org/wiki/STUN] TURN (Traversal Using Relays around NAT): [https://en.wikipedia.org/wiki/Traversal_Using_Relay_NAT https://en.wikipedia.org/wiki/Traversal_Using_Relay_NAT] (Disclaimer: I know nothing of these technologies, I just looked them up on wikipedia myself)
barista 14y ago
>This is the most significant step forward in web browser connectivity since 2004, when Google launched Gmail and AJAX was coined That's not quite right. Microsoft invented XMLHTTP, the interface which XHR is based on, in '98 or '99 for Outlook Web Access.
- dustismo 14y ago
  Notice that he said "AJAX was coined" in 2004 not that the technology was invented.
  - isnotchicago 14y ago
    In the parent's defense, the rest of that paragraph and the chart below it downplay Microsoft's role in favor of Google's, which could be viewed as "not quite right".
  - ams6110 14y ago
    Indeed, myself and others were doing [A]VBAX apps in IE before the term "AJAX" hit the mainstream. Not always async, and using VBScript in the browser instead of Javascript, but loading XML from the server and doing XSLT to build the DOM. It actually was pretty nice, at the time. IE5. You couldn't do things like that in any other browser for years.
- rmc 14y ago
  Yes, XHR was available back then. But it wasn't Ajax. Ajax was invented in '04.
- rmc 14y ago
  Yes, XHR was available back then. But it wasn't Ajax. Ajax was invented in '04.
FakeUserNames 14y ago
Most def. the way things are trending, this is the new big thing. Look Out, the Revolution Sez Go!
phase_9 14y ago
Yet another HTML5 "Game Changer" which has already been available as part of the Adobe Flash Platform[1] for the best part of three years. Just saying :) For those down-voting me; I find this attitude very strange. If the tools were present in another widely deployed runtime, but were heavily under utilised then why are people getting so excited about them this time around? I guess some people just love to hate Flash. [1] http://labs.adobe.com/technologies/cirrus/ http://labs.adobe.com/technologies/cirrus/
- rmc 14y ago
  Less space than a Nomad. No Wireless. Lame.
- wmeredith 14y ago
  Well, stop saying. This is like arguing about the features of a lake when everyone else is playing in the ocean. Flash is proprietary and it doesn't run on mobile. These are both near show-stoppers in, and of, themselves. Combine the two and well, it doesn't matter what else it does. Until flash runs on mobile and/or is an open standard, it won't be relevant to the future of the web most developers (myself included) want to build.
  - daleharvey 14y ago
    Exactly this, the fact that its available in open standards is a game changer for me. The fact that it has been possible with various other technologies for years is not news (for me)
  - novalis 14y ago
    About that ; You can code ActionScript Flash/Flex and run the compiled applications on Google Android, Apple iOS and on BlackBerry Tablet OS. This is possible through the use of the Flex SDK that is under the open source Mozilla Public License, for some time now. As for the lake/ocean analogy attempt, not so much.
- salmanapk 14y ago
  Cool. Will help with polyfill-ing :)
mtgx 14y ago
Since Skype is moving to fully centralized service that can be even more easily wiretapped by Governments around the world (not just US), I'm very excited about the "revolutionary" (literally) capabilities of this protocol, as people will be able to speak 1-on-1 without interference, if the communication is also encrypted. Does being encrypted or not depend on that specific WebRTC client, or does it come encrypted by default like SPDY?
- luciferous 14y ago
  Encryption is mandatory. Currently, the implementation uses SRTP, but the proposal is eventually to use SCTP over DTLS over UDP. [http://tools.ietf.org/html/draft-ietf-rtcweb-data-channel-00#page-6 http://tools.ietf.org/html/draft-ietf-rtcweb-data-channel-00...]
- msutherl 14y ago
  Don't make the mistake of thinking that because the communication channel is "encrypted", it is secure. SSL can already be compromised (so much for trusting encrypted transport) and the WebRTC client code could be compromised (always a problem).
  - Egregore 14y ago
    Can you please provide links on how SSL can be compromised?
    - rmc 14y ago
      It's not SSL per se, but the Certification Authority system that is weak. If you get one of the root CA certs, you can make any SSL cert a valid SSL cert for any domain name.
      - Egregore 14y ago
        It's correct that if root CA is compromised you can make fakes. To protect against this attack browsers should warn when certificate changes, there even is a long standing bug for firefox in mozilla: https://bugzilla.mozilla.org/show_bug.cgi?id=471798 https://bugzilla.mozilla.org/show_bug.cgi?id=471798
mildweed 14y ago
Just in time for Google Fiber here in Kansas City. Excellent timing.
rmc 14y ago
This is very interesting, especially the peer-to-peer browser stuff. With all the attacks on pirate sites lately, it would be interesting to have a new playground for new P2P apps. Joe Soap would be able to get onto P2P by just opening a web page.
christopherscot 14y ago
which should make it about 2016 when we can use it in IE
- vvnraman 14y ago
  Actually you can use it in IE right now using Chrome Frame. Read this for more detailed info - https://groups.google.com/forum/#!msg/discuss-webrtc/tKoh1wrI8ig/MPTdCHpgcm4J[1-25] https://groups.google.com/forum/#!msg/discuss-webrtc/tKoh1wr....
  - molmalo 14y ago
    But when Windows 8 comes out, Chrome Frame will stop being a valid solution, at least for IE's "[Metro|Windows 8|Modern]-style UI" version.
  - Dylan16807 14y ago
    sigh Okay 2016 when we can use it in Trident.
Mizza 14y ago
Even this is a naive understanding of how WebRTC will change the web. Resiliency and decentralization in ways we've never seen before! For more information, check us out at http://WebP2P.org http://WebP2P.org and join in #webp2p on Freenode!
tenko 14y ago
I remember this demo from march, got me all excited :) live streaming video to a webpage, from your phone, that's incredible http://dl.dropbox.com/u/3531958/iphone/webrtc-opera-mobile-12.ogv http://dl.dropbox.com/u/3531958/iphone/webrtc-opera-mobile-1...
silentOpen 14y ago
"Through an open standards approach, WebRTC integrates browser-to-browser communications directly into the fabric of the Internet." Why is this source credible?
vitno 14y ago
for a great multi-user demo of webRTC check out https://bitly.com/webrtcio https://bitly.com/webrtcio and it's resulting library, webRTC.io
vectorpush 14y ago
Look, you're kidding yourself if you think that WebRTC is going to liberate you from the prying eyes of government surveillance. As a developer, I'm very excited about the possibilities that WebRTC enables (websockets just can't cut it in many instances), but computer science is not a panacea for political apathy. P2P is nothing new, and anybody who cares to secure their online communications can already do so with ease, everyone else is happy enough to self document their activities on Facebook.
- thebigshane 14y ago
  Please explain how I can have a secure online conversation with my mother easily. (Easy for me, easy for her). Is it going to involve setting up my own trusted server somewhere? Is it going to involve downloading some large undocumented project and have to build myself (on my box and her box)? Is it going to require troubleshooting arcane protocols, firewalls, and xml files? I haven't seen an easy way to have secure email (without teaching the other side of the conversation cryptography), secure voip/voice (without the trouble above), or secure chat (without using my own server). I'm not saying easy ways don't exist; I'm saying I don't know what or where they are.
  - taligent 14y ago
    No offence but I don't think the government could possibly care less about you or the conversation with your mother. There is a long list of far more important and interesting people for them to worry about. How about using whatever is the easiest, most enjoyable and trouble free setup for her to use.
    - thebigshane 14y ago
      I didn't downvote you. And I agree they aren't interested in my conversations with my mother. However I think they are very much interested in listening in to conversations involving foreign relatives, military relatives, rich relatives, criminal relatives, etc. But none of that is my motivation. My motivation is purely technological. I want secure services as a matter of principle. Since I have yet to find such a thing, I use whatever is easiest, just like everyone else.
shawndumas 14y ago
"This is the most significant step forward in web browser connectivity since 2004, when Google launched Gmail and AJAX was coined." Microsoft --> AJAX[1]. And yes, I know that they aren't saying that Google --> AJAX but it kinda leaves that impression. ---- http://garrettsmith.net/blog/archives/2006/01/microsoft_inven_1.html http://garrettsmith.net/blog/archives/2006/01/microsoft_inve...
- mburns 14y ago
  AJAX as a term and design idea was coined in 2005[1], which is what intent of the quote (though it too is technically inaccurate]. The quote you listed is talking about coining the term, not inventing the technology. If you read the article you linked, it also says this: "Finally -- 6 years later -- Jesse James Garrett of Adaptive Path coined a catchy phrase: the term Ajax was born." [1] http://www.adaptivepath.com/ideas/ajax-new-approach-web-applications http://www.adaptivepath.com/ideas/ajax-new-approach-web-appl...
- scriptproof 14y ago
  Microsoft invented XMLHTTP, an ActiveX object, not XMLHttpRequest, that is similar but not proprietary, and a part of Ajax. And Ajax is a term invented by Garrett - and not Microsoft - that includes several W3C formats.
  - huggyface 14y ago
    "AJAX" the term is a meaningless bit of inaccurate noise (it is wrong in almost every way). No idea what your bit about XMLHttpRequest was, given that was nothing more than a formalizing and cross-platform implementation of Microsoft's COM object (which itself was originally written for Outlook Web Access). Like the GP that bit about AJAX was just all wrong. Garrett is so astonishingly irrelevant in all of this, as is the AJAX me-too title. Google was very important, but only insofar as they legitimized the technique and made a lot of people realize that this crazy web thing was a lot more powerful than people often thought. And it wasn't gmail -- it was Google Suggests. That was an atomic bomb on webapps that proved that highly dynamic pages were possible and preferable. Me - using XmlHttp(Request) since 2001.
metaxyy 14y ago
I can't tell what they mean by this: "If all goes according to plan, over 50% of all web browsers will support this capability in the next three to four months." There are only five browsers that count, so why didn't they just say "three of the five major browsers?" Or, if they mean more than 50% of browser installations, are we really at the point where we can get 50% of all browser installations updated within a couple of months?
- mtgx 14y ago
  Yes, I think Chrome and Firefox can achieve that within 3-4 months.
- taligent 14y ago
  Chrome + Firefox are around 60% of current browser installations and both currently self-update so that is likely where he got that figure. It does neglect to mention that not all Firefox browsers do self-update so that would need to be factored in.
moonchrome 14y ago
Here comes the glorious HTML5 revolution, reinventing things that were around for decades, but now that it's "a standard" and "in javascript" it changes everything. First it was sockets, then it was WebGL now P2P. I wonder what revolution we will have next - a standardized file system access.
- macspoofing 14y ago
  Actually yeah. It does make a difference if it runs in a browser.
suryaprakashrao 14y ago
very interesting
tinfoilhat 14y ago
from http://www.webrtc.org/running-the-demos#TOC-Demos http://www.webrtc.org/running-the-demos#TOC-Demos : Justin Uberti (Chrome-webrtc team member) has sent in a App Engine based 1:1 video calling app. http://apprtc.appspot.com/ http://apprtc.appspot.com/ source code: http://code.google.com/p/webrtc-samples/source/browse/trunk/apprtc/ http://code.google.com/p/webrtc-samples/source/browse/trunk/... after source code reading (and chrome dev console output observing) you have to realize: 1. there is need of 'signaling server' 2. session encryption keys are exchanged through that server yes, anyone could setup their small server and call through it an make sure tls / ssl cert of their server is intact etc. that will not be a case for avg Joe. not to mention tat browser itself will be an attack vector.
rohit01 14y ago
Nice post. WebRTC is great!
jan_g 14y ago
Is no one here worried about (again!) audio/video codecs and presence implementation? As far as I've read webrtc specs there are no specifics, they've left implementation details in the hands of implementors. I fear that Microsoft will push something skype-specific, Google (and possibly Mozilla) vp8 and xmpp/jingle, who knows what Apple will do with Safari. And different clients/browsers won't be able to communicate between themselves.
- slurgfest 14y ago
  vp8/xmpp/jingle are open standards with open implementations, and Safari is a Webkit browser with a pretty good track record. Whatever Apple's problems, it doesn't seem too uncomfortable with using stuff that is BSD licensed. Nobody can force Microsoft to support open standards, without the leverage of popular adoption and demand. So it makes no sense to wait on Microsoft to support open standards before trying to use them. So if browsers can't talk to each other, whose fault is that? If Microsoft decides to be the odd man out, it's Microsoft's fault. If everyone else allows open standards to be suppressed as they wait for Microsoft, then they will be responsible for a world where Microsoft controls everything. Is that really what you are looking for here? Anyway, these days Microsoft has shifted more support away from things like Silverlight, so I think there is a good hope that things will not be just like the bad old days.
  - jan_g 14y ago
    You haven't forgotten HTML5 <video> element, have you?
  - bzbarsky 14y ago
    VP8 is BSD-licensed. It's not supported in Safari and Apple has said they have no plans to do so. That's because this whole codec thing is about patent licensing, not copyright licensing, so the fact that the code is BSD-licensed for copyright purposes is irrelevant. The result is that for the HTML video tag, for example, it's Apple and Microsoft that don't support VP8 and Theora, and Mozilla and Opera that don't support H.264, all for patent licensing, not copyright, reasons. The corresponding situation with WebRTC is still in flux.
ZoFreX 14y ago
While this tech is exciting for a wide variety of reasons, this blog post completely misses the point for me in its efforts to hype this. > imagine it amplified by secure, real-time transmissions of audio and video Ok, I'm imagining it. And I'll still be imagining it in 12 months time, because WebRTC does nothing to fix the outstanding issues in setting up secure communications. > Skype, Cisco, and Polycom will all see their conferencing technology commoditized. Really? Surely you could have said that Cisco / Polycom would be destroyed by Skype, but that didn't happen. Why would in-browser conferencing, which will almost certainly be a worse experience than Skype, which is itself a far worse experience than dedicated conference hardware/software, commoditize conference technology? And for that matter, why did the wide variety of already-existing browser-based conferencing tech not do this? Personally I'm more excited about ideas like P2P downloading, and using DHTs to disseminate information.
- JoshTriplett 14y ago
  > Why would in-browser conferencing, which will almost certainly be a worse experience than Skype What would give you that impression? A site that lets you automatically join a conference call just by visiting a page seems far more usable than Skype.
  - ZoFreX 14y ago
    Because a general purpose device (in this case, the browser) generally falls behind in a few ways compared to a specific purpose device (in this case Skype). A few examples: Stability: For Skype to break, you need to either crash Skype or the entire computer or O/S. For your in-browser conferencing, you just need the web browser to crash. Connectivity: Skype has put huge amounts of work into punching through firewalls, and has many settings dedicated to that. Furthermore it's a common enough option on SOHO/consumer routers to let it through. P2P browser connectivity just isn't there yet. Security: Our firewall at work is configured to allow Skype through. I doubt it's configured to let browsers open direct raw socket connections to any IP and port they please. I can't even begin to imagine how a network administrator is supposed to lock these capabilities down, other than completely disallowing them. UX: Again, Skype is a dedicated program so it can do a lot more. It can keep a little overlay window open in the corner of your screen so you can look at a web page or document but keep an eye on your call. It can hook into the O/S to ensure your microphone is selected and unmuted. It can tell your music player to pause when a call comes in. None of this is possible with a browser (yes, you could add APIs, but where do you stop - are browsers going to become the next JVM, creating a cross-platform API that plasters over the differences between O/S's?) My last point is mildly tangential: Why would P2P in-browser conferencing disrupt Skype / Polycom when it has literally zero perceivable difference to the end-user compared to regular client-server in-browser conferencing (other than the fact that with P2P you will be able to connect to fewer people than in the client-server model)?
moe 14y ago
And when you screw off the wheel it can double as a mop! What exactly does it help to have your video-feed drive around on a broomstick? I can see the entertainment value for a couple days. But when it's time to get work done again I sure as hell don't see people preferring a video broomstick next to their desk over a plain old skype-window...
- slurgfest 14y ago
  Not sure what you're getting at by "drive around on a broomstick." To be sure, the article is more breathless than it needs to be. WebRTC seems to my untutored eye to be a boring, practical, good idea. Skype is a proprietary service which (last I checked) still requires you to locally install their binary, and is completely under the control of one company... as a risk-averse person I wouldn't bet the farm building on top of any technology which requires me to swear fealty to Skype or Facebook, because who knows what will happen in a year?
ajankovic 14y ago
These capabilities open the door to a new wave of advanced web applications. I have read this line as: These capabilities open the door to a new wave of advanced web security issues.
magnusgraviti 14y ago
I just started learning more about WebRTC and it looks like an interesting foundation for numerous startups. New technology among others to help solving specific tasks.

146 points by denismars 14y ago

At the moment, NAT means that lots of connections have to go through a central server, at least to set up the connection. With IPv6, that need should vanish (providing you aren't firewalled by your router). The two things combined should remove a lot of middlemen.

dustismo 14y ago
Exactly. Almost everyone is behind a router so there is no way this is going to be as useful as stated in the article.
- arendn 14y ago
  P2P firewall traversal is pretty common these days. Checkout STUN/ICE/TURN.
- drivebyacct2 14y ago
  Every example I'm aware of for WebRTC right now uses STUN. It's part of ROAP and it's possible in JSEP (and easier, with ROAP-via-JSEP library). Nah, everyone is just claiming this to be awesome and just happened to forget about NAT routers....
- dustismo 14y ago
  I stand corrected :). I was just reading up on STUN, it is a very interesting solution.
rfolstad 14y ago
Actually check out the webrtc talk from googleio. They use the NAT device's IP to get around this. http://www.youtube.com/watch?v=E8C8ouiXHHk http://www.youtube.com/watch?v=E8C8ouiXHHk
drivebyacct2 14y ago
IPv6 does not mean the end of NAT, and WebRTC ROAP or JSEP already have ICE style STUN/TURN traversal mechanisms. (4 months ago I had a demo working using ROAP and STUN before they switched to JSEP. I'm literally in the middle of upgrading it to the new API.) The "setup" for the connections in the central server is trivial with a tiny websockets server and a few messages shuttled back and forth.
- zanny 14y ago
  Holy acroynm city batman.
- thebigshane 14y ago
  For reference for others: NAT (Network Address Traversal): exposing only your router's ip address and hiding your own to outside traffic [https://en.wikipedia.org/wiki/Network_address_translation https://en.wikipedia.org/wiki/Network_address_translation] ROAP (RTCWeb Offer/Answer Protocol): main voice protocol [https://en.wikipedia.org/wiki/RTCWeb_Offer/Answer_Protocol https://en.wikipedia.org/wiki/RTCWeb_Offer/Answer_Protocol] JSEP (JavaScript Session Establishment Protocol): protocol for setting up P2P connection [https://en.wikipedia.org/wiki/JavaScript_Session_Establishment_Protocol https://en.wikipedia.org/wiki/JavaScript_Session_Establishme...] Following are all technologies for punching through NAT... ICE (Interactive Connectivity Establishment): [https://en.wikipedia.org/wiki/Interactive_Connectivity_Establishment https://en.wikipedia.org/wiki/Interactive_Connectivity_Estab...] STUN (Session Traversal Utilities for NAT): [https://en.wikipedia.org/wiki/STUN https://en.wikipedia.org/wiki/STUN] TURN (Traversal Using Relays around NAT): [https://en.wikipedia.org/wiki/Traversal_Using_Relay_NAT https://en.wikipedia.org/wiki/Traversal_Using_Relay_NAT] (Disclaimer: I know nothing of these technologies, I just looked them up on wikipedia myself)

barista 14y ago

>This is the most significant step forward in web browser connectivity since 2004, when Google launched Gmail and AJAX was coined That's not quite right. Microsoft invented XMLHTTP, the interface which XHR is based on, in '98 or '99 for Outlook Web Access.

dustismo 14y ago
Notice that he said "AJAX was coined" in 2004 not that the technology was invented.
- isnotchicago 14y ago
  In the parent's defense, the rest of that paragraph and the chart below it downplay Microsoft's role in favor of Google's, which could be viewed as "not quite right".
- ams6110 14y ago
  Indeed, myself and others were doing [A]VBAX apps in IE before the term "AJAX" hit the mainstream. Not always async, and using VBScript in the browser instead of Javascript, but loading XML from the server and doing XSLT to build the DOM. It actually was pretty nice, at the time. IE5. You couldn't do things like that in any other browser for years.
rmc 14y ago
Yes, XHR was available back then. But it wasn't Ajax. Ajax was invented in '04.
rmc 14y ago
Yes, XHR was available back then. But it wasn't Ajax. Ajax was invented in '04.

FakeUserNames 14y ago

Most def. the way things are trending, this is the new big thing. Look Out, the Revolution Sez Go!

phase_9 14y ago

Yet another HTML5 "Game Changer" which has already been available as part of the Adobe Flash Platform[1] for the best part of three years. Just saying :) For those down-voting me; I find this attitude very strange. If the tools were present in another widely deployed runtime, but were heavily under utilised then why are people getting so excited about them this time around? I guess some people just love to hate Flash. [1] http://labs.adobe.com/technologies/cirrus/ http://labs.adobe.com/technologies/cirrus/

rmc 14y ago
Less space than a Nomad. No Wireless. Lame.
wmeredith 14y ago
Well, stop saying. This is like arguing about the features of a lake when everyone else is playing in the ocean. Flash is proprietary and it doesn't run on mobile. These are both near show-stoppers in, and of, themselves. Combine the two and well, it doesn't matter what else it does. Until flash runs on mobile and/or is an open standard, it won't be relevant to the future of the web most developers (myself included) want to build.
- daleharvey 14y ago
  Exactly this, the fact that its available in open standards is a game changer for me. The fact that it has been possible with various other technologies for years is not news (for me)
- novalis 14y ago
  About that ; You can code ActionScript Flash/Flex and run the compiled applications on Google Android, Apple iOS and on BlackBerry Tablet OS. This is possible through the use of the Flex SDK that is under the open source Mozilla Public License, for some time now. As for the lake/ocean analogy attempt, not so much.
salmanapk 14y ago
Cool. Will help with polyfill-ing :)

mtgx 14y ago

Since Skype is moving to fully centralized service that can be even more easily wiretapped by Governments around the world (not just US), I'm very excited about the "revolutionary" (literally) capabilities of this protocol, as people will be able to speak 1-on-1 without interference, if the communication is also encrypted. Does being encrypted or not depend on that specific WebRTC client, or does it come encrypted by default like SPDY?

luciferous 14y ago
Encryption is mandatory. Currently, the implementation uses SRTP, but the proposal is eventually to use SCTP over DTLS over UDP. [http://tools.ietf.org/html/draft-ietf-rtcweb-data-channel-00#page-6 http://tools.ietf.org/html/draft-ietf-rtcweb-data-channel-00...]
msutherl 14y ago
Don't make the mistake of thinking that because the communication channel is "encrypted", it is secure. SSL can already be compromised (so much for trusting encrypted transport) and the WebRTC client code could be compromised (always a problem).
- Egregore 14y ago
  Can you please provide links on how SSL can be compromised?
  - rmc 14y ago
    It's not SSL per se, but the Certification Authority system that is weak. If you get one of the root CA certs, you can make any SSL cert a valid SSL cert for any domain name.
    - Egregore 14y ago
      It's correct that if root CA is compromised you can make fakes. To protect against this attack browsers should warn when certificate changes, there even is a long standing bug for firefox in mozilla: https://bugzilla.mozilla.org/show_bug.cgi?id=471798 https://bugzilla.mozilla.org/show_bug.cgi?id=471798

mildweed 14y ago

Just in time for Google Fiber here in Kansas City. Excellent timing.

rmc 14y ago

This is very interesting, especially the peer-to-peer browser stuff. With all the attacks on pirate sites lately, it would be interesting to have a new playground for new P2P apps. Joe Soap would be able to get onto P2P by just opening a web page.

christopherscot 14y ago

which should make it about 2016 when we can use it in IE

vvnraman 14y ago
Actually you can use it in IE right now using Chrome Frame. Read this for more detailed info - https://groups.google.com/forum/#!msg/discuss-webrtc/tKoh1wrI8ig/MPTdCHpgcm4J[1-25] https://groups.google.com/forum/#!msg/discuss-webrtc/tKoh1wr....
- molmalo 14y ago
  But when Windows 8 comes out, Chrome Frame will stop being a valid solution, at least for IE's "[Metro|Windows 8|Modern]-style UI" version.
- Dylan16807 14y ago
  sigh Okay 2016 when we can use it in Trident.

Mizza 14y ago

Even this is a naive understanding of how WebRTC will change the web. Resiliency and decentralization in ways we've never seen before! For more information, check us out at http://WebP2P.org http://WebP2P.org and join in #webp2p on Freenode!

tenko 14y ago

I remember this demo from march, got me all excited :) live streaming video to a webpage, from your phone, that's incredible http://dl.dropbox.com/u/3531958/iphone/webrtc-opera-mobile-12.ogv http://dl.dropbox.com/u/3531958/iphone/webrtc-opera-mobile-1...

silentOpen 14y ago

"Through an open standards approach, WebRTC integrates browser-to-browser communications directly into the fabric of the Internet." Why is this source credible?

vitno 14y ago

for a great multi-user demo of webRTC check out https://bitly.com/webrtcio https://bitly.com/webrtcio and it's resulting library, webRTC.io

vectorpush 14y ago

Look, you're kidding yourself if you think that WebRTC is going to liberate you from the prying eyes of government surveillance. As a developer, I'm very excited about the possibilities that WebRTC enables (websockets just can't cut it in many instances), but computer science is not a panacea for political apathy. P2P is nothing new, and anybody who cares to secure their online communications can already do so with ease, everyone else is happy enough to self document their activities on Facebook.

thebigshane 14y ago
Please explain how I can have a secure online conversation with my mother easily. (Easy for me, easy for her). Is it going to involve setting up my own trusted server somewhere? Is it going to involve downloading some large undocumented project and have to build myself (on my box and her box)? Is it going to require troubleshooting arcane protocols, firewalls, and xml files? I haven't seen an easy way to have secure email (without teaching the other side of the conversation cryptography), secure voip/voice (without the trouble above), or secure chat (without using my own server). I'm not saying easy ways don't exist; I'm saying I don't know what or where they are.
- taligent 14y ago
  No offence but I don't think the government could possibly care less about you or the conversation with your mother. There is a long list of far more important and interesting people for them to worry about. How about using whatever is the easiest, most enjoyable and trouble free setup for her to use.
  - thebigshane 14y ago
    I didn't downvote you. And I agree they aren't interested in my conversations with my mother. However I think they are very much interested in listening in to conversations involving foreign relatives, military relatives, rich relatives, criminal relatives, etc. But none of that is my motivation. My motivation is purely technological. I want secure services as a matter of principle. Since I have yet to find such a thing, I use whatever is easiest, just like everyone else.

shawndumas 14y ago

"This is the most significant step forward in web browser connectivity since 2004, when Google launched Gmail and AJAX was coined." Microsoft --> AJAX[1]. And yes, I know that they aren't saying that Google --> AJAX but it kinda leaves that impression. ---- http://garrettsmith.net/blog/archives/2006/01/microsoft_inven_1.html http://garrettsmith.net/blog/archives/2006/01/microsoft_inve...

mburns 14y ago
AJAX as a term and design idea was coined in 2005[1], which is what intent of the quote (though it too is technically inaccurate]. The quote you listed is talking about coining the term, not inventing the technology. If you read the article you linked, it also says this: "Finally -- 6 years later -- Jesse James Garrett of Adaptive Path coined a catchy phrase: the term Ajax was born." [1] http://www.adaptivepath.com/ideas/ajax-new-approach-web-applications http://www.adaptivepath.com/ideas/ajax-new-approach-web-appl...
scriptproof 14y ago
Microsoft invented XMLHTTP, an ActiveX object, not XMLHttpRequest, that is similar but not proprietary, and a part of Ajax. And Ajax is a term invented by Garrett - and not Microsoft - that includes several W3C formats.
- huggyface 14y ago
  "AJAX" the term is a meaningless bit of inaccurate noise (it is wrong in almost every way). No idea what your bit about XMLHttpRequest was, given that was nothing more than a formalizing and cross-platform implementation of Microsoft's COM object (which itself was originally written for Outlook Web Access). Like the GP that bit about AJAX was just all wrong. Garrett is so astonishingly irrelevant in all of this, as is the AJAX me-too title. Google was very important, but only insofar as they legitimized the technique and made a lot of people realize that this crazy web thing was a lot more powerful than people often thought. And it wasn't gmail -- it was Google Suggests. That was an atomic bomb on webapps that proved that highly dynamic pages were possible and preferable. Me - using XmlHttp(Request) since 2001.

metaxyy 14y ago

I can't tell what they mean by this: "If all goes according to plan, over 50% of all web browsers will support this capability in the next three to four months." There are only five browsers that count, so why didn't they just say "three of the five major browsers?" Or, if they mean more than 50% of browser installations, are we really at the point where we can get 50% of all browser installations updated within a couple of months?

mtgx 14y ago
Yes, I think Chrome and Firefox can achieve that within 3-4 months.
taligent 14y ago
Chrome + Firefox are around 60% of current browser installations and both currently self-update so that is likely where he got that figure. It does neglect to mention that not all Firefox browsers do self-update so that would need to be factored in.

moonchrome 14y ago

Here comes the glorious HTML5 revolution, reinventing things that were around for decades, but now that it's "a standard" and "in javascript" it changes everything. First it was sockets, then it was WebGL now P2P. I wonder what revolution we will have next - a standardized file system access.

macspoofing 14y ago
Actually yeah. It does make a difference if it runs in a browser.

suryaprakashrao 14y ago

very interesting

tinfoilhat 14y ago

from http://www.webrtc.org/running-the-demos#TOC-Demos http://www.webrtc.org/running-the-demos#TOC-Demos : Justin Uberti (Chrome-webrtc team member) has sent in a App Engine based 1:1 video calling app. http://apprtc.appspot.com/ http://apprtc.appspot.com/ source code: http://code.google.com/p/webrtc-samples/source/browse/trunk/apprtc/ http://code.google.com/p/webrtc-samples/source/browse/trunk/... after source code reading (and chrome dev console output observing) you have to realize: 1. there is need of 'signaling server' 2. session encryption keys are exchanged through that server yes, anyone could setup their small server and call through it an make sure tls / ssl cert of their server is intact etc. that will not be a case for avg Joe. not to mention tat browser itself will be an attack vector.

rohit01 14y ago

Nice post. WebRTC is great!

jan_g 14y ago

Is no one here worried about (again!) audio/video codecs and presence implementation? As far as I've read webrtc specs there are no specifics, they've left implementation details in the hands of implementors. I fear that Microsoft will push something skype-specific, Google (and possibly Mozilla) vp8 and xmpp/jingle, who knows what Apple will do with Safari. And different clients/browsers won't be able to communicate between themselves.

slurgfest 14y ago
vp8/xmpp/jingle are open standards with open implementations, and Safari is a Webkit browser with a pretty good track record. Whatever Apple's problems, it doesn't seem too uncomfortable with using stuff that is BSD licensed. Nobody can force Microsoft to support open standards, without the leverage of popular adoption and demand. So it makes no sense to wait on Microsoft to support open standards before trying to use them. So if browsers can't talk to each other, whose fault is that? If Microsoft decides to be the odd man out, it's Microsoft's fault. If everyone else allows open standards to be suppressed as they wait for Microsoft, then they will be responsible for a world where Microsoft controls everything. Is that really what you are looking for here? Anyway, these days Microsoft has shifted more support away from things like Silverlight, so I think there is a good hope that things will not be just like the bad old days.
- jan_g 14y ago
  You haven't forgotten HTML5 <video> element, have you?
- bzbarsky 14y ago
  VP8 is BSD-licensed. It's not supported in Safari and Apple has said they have no plans to do so. That's because this whole codec thing is about patent licensing, not copyright licensing, so the fact that the code is BSD-licensed for copyright purposes is irrelevant. The result is that for the HTML video tag, for example, it's Apple and Microsoft that don't support VP8 and Theora, and Mozilla and Opera that don't support H.264, all for patent licensing, not copyright, reasons. The corresponding situation with WebRTC is still in flux.

ZoFreX 14y ago

While this tech is exciting for a wide variety of reasons, this blog post completely misses the point for me in its efforts to hype this. > imagine it amplified by secure, real-time transmissions of audio and video Ok, I'm imagining it. And I'll still be imagining it in 12 months time, because WebRTC does nothing to fix the outstanding issues in setting up secure communications. > Skype, Cisco, and Polycom will all see their conferencing technology commoditized. Really? Surely you could have said that Cisco / Polycom would be destroyed by Skype, but that didn't happen. Why would in-browser conferencing, which will almost certainly be a worse experience than Skype, which is itself a far worse experience than dedicated conference hardware/software, commoditize conference technology? And for that matter, why did the wide variety of already-existing browser-based conferencing tech not do this? Personally I'm more excited about ideas like P2P downloading, and using DHTs to disseminate information.

JoshTriplett 14y ago
> Why would in-browser conferencing, which will almost certainly be a worse experience than Skype What would give you that impression? A site that lets you automatically join a conference call just by visiting a page seems far more usable than Skype.
- ZoFreX 14y ago
  Because a general purpose device (in this case, the browser) generally falls behind in a few ways compared to a specific purpose device (in this case Skype). A few examples: Stability: For Skype to break, you need to either crash Skype or the entire computer or O/S. For your in-browser conferencing, you just need the web browser to crash. Connectivity: Skype has put huge amounts of work into punching through firewalls, and has many settings dedicated to that. Furthermore it's a common enough option on SOHO/consumer routers to let it through. P2P browser connectivity just isn't there yet. Security: Our firewall at work is configured to allow Skype through. I doubt it's configured to let browsers open direct raw socket connections to any IP and port they please. I can't even begin to imagine how a network administrator is supposed to lock these capabilities down, other than completely disallowing them. UX: Again, Skype is a dedicated program so it can do a lot more. It can keep a little overlay window open in the corner of your screen so you can look at a web page or document but keep an eye on your call. It can hook into the O/S to ensure your microphone is selected and unmuted. It can tell your music player to pause when a call comes in. None of this is possible with a browser (yes, you could add APIs, but where do you stop - are browsers going to become the next JVM, creating a cross-platform API that plasters over the differences between O/S's?) My last point is mildly tangential: Why would P2P in-browser conferencing disrupt Skype / Polycom when it has literally zero perceivable difference to the end-user compared to regular client-server in-browser conferencing (other than the fact that with P2P you will be able to connect to fewer people than in the client-server model)?

moe 14y ago

And when you screw off the wheel it can double as a mop! What exactly does it help to have your video-feed drive around on a broomstick? I can see the entertainment value for a couple days. But when it's time to get work done again I sure as hell don't see people preferring a video broomstick next to their desk over a plain old skype-window...

slurgfest 14y ago
Not sure what you're getting at by "drive around on a broomstick." To be sure, the article is more breathless than it needs to be. WebRTC seems to my untutored eye to be a boring, practical, good idea. Skype is a proprietary service which (last I checked) still requires you to locally install their binary, and is completely under the control of one company... as a risk-averse person I wouldn't bet the farm building on top of any technology which requires me to swear fealty to Skype or Facebook, because who knows what will happen in a year?

ajankovic 14y ago

These capabilities open the door to a new wave of advanced web applications. I have read this line as: These capabilities open the door to a new wave of advanced web security issues.

magnusgraviti 14y ago

I just started learning more about WebRTC and it looks like an interesting foundation for numerous startups. New technology among others to help solving specific tasks.