5 ms·

Please do not do this. You should not instruct users to change flags in order to use this. This opens up fairly serious security loopholes as malicious website

Please do not do this. You should not instruct users to change flags in order to use this. This opens up fairly serious security loopholes as malicious websites can start screensharing without being instantiated by the user. Instead of using the getUserMedia API directly, you should use Chrome's chooseDesktopMedia API to get a desktop capture source (the screen, a tab, or any application window). The chooseDesktopMedia API is available in Chrome 34+ and can be used to do desktop screen capture/share without asking the user to enable flags. As of 6 hours ago, the flag (#enable-usermedia-screen-capture) has been removed and will not be present in Chrome 35 Stable. [Ref: https://codereview.chromium.org/270353002 https://codereview.chromium.org/270353002 & https://code.google.com/p/chromium/issues/detail?id=347641 https://code.google.com/p/chromium/issues/detail?id=347641] In any case, cool hack!

dshankar 12y ago
Another benefit of using cDM: more visitors to your site would be able to use your app right now instead of posting "Chrome vers. doesn't work" :-) 20% of the world (and likely an even larger percentage of HN users) already have cDM support! [http://caniuse.com/usage_table.php http://caniuse.com/usage_table.php]
- gk1 12y ago
  I was excited about this at first. I don't know of any simple way to record my screen without having to download decade-old software. A web-based solution like this would be amazing... Until I realized I'd have to follow a list of work-arounds just to get it working. Hoping this is just the first trial run and the next iteration will get this resolved.
  - dshankar 12y ago
    The getUserMedia API is still fairly early. If the OP used the chooseDesktopMedia API in concert with getUserMedia and built a Chrome Extension, you wouldn't have to do any of these work-arounds. I expect an enormous number of Chrome Extensions that do all sorts of web-based screen recording & sharing in the coming months.
randall 12y ago
(yo Darshan!) Correct me if I'm wrong but isn't that api an extension only api? https://developer.chrome.com/extensions/desktopCapture https://developer.chrome.com/extensions/desktopCapture
- cpncrunch 12y ago
  It does look like it is only for extensions. Does this mean it will now be impossible for users to use desktop sharing from web apps? I don't really see the security problem. Right now there is a popup asking if you want to share your screen, and there is also a permanent warning at the bottom of the screen while the screen is being shared. Also it is only available on https sites. What possible security risk is there?
  - dshankar 12y ago
    In M34, a user can still use getUserMedia with a screen media source as long as they enable the flag. In M35+, the flag will no longer appear. Thus, the only way to get a screen media source (tab, screen, window etc.) in the first place is to use the chooseDesktopMedia API. That will give you a source id to use with the getUserMedia API.
- dshankar 12y ago
  (Hey Randall! :-) Yes, it requires an extension and that's the way it ought to be. Explicit user-intent, properly sandboxed. Allowing any website to arbitrarily capture your entire desktop screen (or any application screen) is an enormous security risk that shouldn't be taken lightly, so an extension seems like the right decision.
  - cpncrunch 12y ago
    Here's the issue...our product is an html5 cross-platform web conferencing platform. Users simply click on a link to join a session. Our product isn't an extension - it's simply html and javascript. So basically you're saying that we either need to change the architecture of our app for Chrome so that it is an extension, or else put the screen-sharing part into an extension. (I'm guessing our entire app would need to be an extension, due to 'sandboxing', although I'm not certain). To be honest I'm not sure why we should change to an extension just for chrome (and just to get screen sharing). It's a bit like telling us we need to rewrite our app in NaCl just for chrome :) Ideally I would like a cross-platform screen sharing feature in getUserMedia, similar to how it worked in Chrome (but without the user having to set any flags). I don't really buy the arguments in http://tools.ietf.org/html/draft-ietf-rtcweb-security-06#section-4.1.1 http://tools.ietf.org/html/draft-ietf-rtcweb-security-06#sec.... Worst case is a dumb user gives permission to screen share to a dodgy site which then reads their bank balance and/or emails (but can't get access to any passwords). If that's a concern then why not just have a small preview window showing exactly what is being shared?
thrush 12y ago
Even with security risk, this is a bit of a golden egg for automated selenium testing!

dshankar 12y ago

Another benefit of using cDM: more visitors to your site would be able to use your app right now instead of posting "Chrome vers. doesn't work" :-) 20% of the world (and likely an even larger percentage of HN users) already have cDM support! [http://caniuse.com/usage_table.php http://caniuse.com/usage_table.php]

gk1 12y ago
I was excited about this at first. I don't know of any simple way to record my screen without having to download decade-old software. A web-based solution like this would be amazing... Until I realized I'd have to follow a list of work-arounds just to get it working. Hoping this is just the first trial run and the next iteration will get this resolved.
- dshankar 12y ago
  The getUserMedia API is still fairly early. If the OP used the chooseDesktopMedia API in concert with getUserMedia and built a Chrome Extension, you wouldn't have to do any of these work-arounds. I expect an enormous number of Chrome Extensions that do all sorts of web-based screen recording & sharing in the coming months.

randall 12y ago

(yo Darshan!) Correct me if I'm wrong but isn't that api an extension only api? https://developer.chrome.com/extensions/desktopCapture https://developer.chrome.com/extensions/desktopCapture

cpncrunch 12y ago
It does look like it is only for extensions. Does this mean it will now be impossible for users to use desktop sharing from web apps? I don't really see the security problem. Right now there is a popup asking if you want to share your screen, and there is also a permanent warning at the bottom of the screen while the screen is being shared. Also it is only available on https sites. What possible security risk is there?
- dshankar 12y ago
  In M34, a user can still use getUserMedia with a screen media source as long as they enable the flag. In M35+, the flag will no longer appear. Thus, the only way to get a screen media source (tab, screen, window etc.) in the first place is to use the chooseDesktopMedia API. That will give you a source id to use with the getUserMedia API.
dshankar 12y ago
(Hey Randall! :-) Yes, it requires an extension and that's the way it ought to be. Explicit user-intent, properly sandboxed. Allowing any website to arbitrarily capture your entire desktop screen (or any application screen) is an enormous security risk that shouldn't be taken lightly, so an extension seems like the right decision.
- cpncrunch 12y ago
  Here's the issue...our product is an html5 cross-platform web conferencing platform. Users simply click on a link to join a session. Our product isn't an extension - it's simply html and javascript. So basically you're saying that we either need to change the architecture of our app for Chrome so that it is an extension, or else put the screen-sharing part into an extension. (I'm guessing our entire app would need to be an extension, due to 'sandboxing', although I'm not certain). To be honest I'm not sure why we should change to an extension just for chrome (and just to get screen sharing). It's a bit like telling us we need to rewrite our app in NaCl just for chrome :) Ideally I would like a cross-platform screen sharing feature in getUserMedia, similar to how it worked in Chrome (but without the user having to set any flags). I don't really buy the arguments in http://tools.ietf.org/html/draft-ietf-rtcweb-security-06#section-4.1.1 http://tools.ietf.org/html/draft-ietf-rtcweb-security-06#sec.... Worst case is a dumb user gives permission to screen share to a dodgy site which then reads their bank balance and/or emails (but can't get access to any passwords). If that's a concern then why not just have a small preview window showing exactly what is being shared?

thrush 12y ago

Even with security risk, this is a bit of a golden egg for automated selenium testing!