There are no downloads or plugins to make it work. All data moves through WebRTC after just a 2 lines of js. Web pages enabled with Peer5 look exactly the same as they did before it was implemented.
They could notice if monitoring upstream bandwidth, although this would be absolutley negligible on Wifi connections.
I did not expect that WebRTC would allow a website to make the browser deliver content to a 3rd party without the users consent. This has some strange privacy and copyright implications.
That's a very much talked about subject in the standardization groups. They've concluded that WebRTC doesn't add any additional privacy or security exposure than what exists in the browsers previous to it.
Can you please explain more why you think there are copyright implications?
I'm not sure about the US, but in the EU and in particular in my country of France, anti-piracy lawsuits have seen a very clearly drawn line between a mere downloader, and an uploader. That's what lead emule and bittorrent to be "dangerous" legally while direct downloading (newsgroup, rapidshare, ...) and streaming almost never led to conviction (even symbolic). That the user didn't realize his bittorrent was re-uploading content to others didn't matter.
So, if I visit a website to get, say, direct copyrighted content (let's say photo, comics, music, whatever) and that website uses webrtc to make me reshare it to other users, my legal status just went from a almost never convicted downloader to a very much punished (even though it stayed symbolic, it was still a legal loss) uploader.
What's different in the CDN use-case is that the content that reached a 3rd user through the uploading user would've reached the 3rd anyway, just from the original server.
Yeah but from the point of view of the (unexpecting) uploader that doesn't change anything. If user A wasn't uploading, user B would still get the files from other peers on the torrent, doesn't change the fact A was sharing and actively uploading the file.
Not trying to throw a wrench in your game, but I think this is something you guys need to have a look into because you're turning unsuspecting users into uploaders of content they have no control over, without noticing it, when it has been proven to cause them legal harm.
They've concluded that WebRTC doesn't add any additional privacy or security exposure than what exists in the browsers previous to it.
Even the WebRTC standard talks quite a bit about it in the Privacy and Security Considerations section, some quotes:
Revealing IP addresses can leak location and means of connection; this can be sensitive. Depending on the network environment, it can also increase the fingerprinting surface and create persistent cross-origin state that cannot easily be cleared by the user.
[...]
These choices can for instance be made by the application based on whether the user has indicated consent to start a media connection with the other party.
On standards without additional exposure, this section normally says so and is otherwise empty.
Exposing other visitors IPs is a pretty massive leak (at least some jurisdictions consider them PII, with the consequences to match), presenting that as "no additional privacy exposure" is just negligent (or more likely intentionally misleading).
That's not true because you send or receive data from other peers only if you are already watching a video.
In other words - p2p is used only in places where the data would have gotten from the server anyways (e.g. p2p didn't add any new users to the equation)
You A are getting content from server S.
B is getting the same content from server S.
With this CDN, what changes is that A is now sending content to B. Content that may be illegal. The fact that would mean A was accessing illegal content doesn't change the fact that this CDN moves him from a downloader to an uploader, without his content nor telling him, something that has legal precedent for leading to convictions in europe.
Comments
You can turn a website visitor into a content delivery endpoint without them even noticing? I find that hard to believe.
There are no downloads or plugins to make it work. All data moves through WebRTC after just a 2 lines of js. Web pages enabled with Peer5 look exactly the same as they did before it was implemented.
They could notice if monitoring upstream bandwidth, although this would be absolutley negligible on Wifi connections.
I did not expect that WebRTC would allow a website to make the browser deliver content to a 3rd party without the users consent. This has some strange privacy and copyright implications.
That's a very much talked about subject in the standardization groups. They've concluded that WebRTC doesn't add any additional privacy or security exposure than what exists in the browsers previous to it. Can you please explain more why you think there are copyright implications?
I'm not sure about the US, but in the EU and in particular in my country of France, anti-piracy lawsuits have seen a very clearly drawn line between a mere downloader, and an uploader. That's what lead emule and bittorrent to be "dangerous" legally while direct downloading (newsgroup, rapidshare, ...) and streaming almost never led to conviction (even symbolic). That the user didn't realize his bittorrent was re-uploading content to others didn't matter.
So, if I visit a website to get, say, direct copyrighted content (let's say photo, comics, music, whatever) and that website uses webrtc to make me reshare it to other users, my legal status just went from a almost never convicted downloader to a very much punished (even though it stayed symbolic, it was still a legal loss) uploader.
What's different in the CDN use-case is that the content that reached a 3rd user through the uploading user would've reached the 3rd anyway, just from the original server.
Yeah but from the point of view of the (unexpecting) uploader that doesn't change anything. If user A wasn't uploading, user B would still get the files from other peers on the torrent, doesn't change the fact A was sharing and actively uploading the file.
Not trying to throw a wrench in your game, but I think this is something you guys need to have a look into because you're turning unsuspecting users into uploaders of content they have no control over, without noticing it, when it has been proven to cause them legal harm.
We're definitely looking into that, AFAIK for now, is that as long as the content is legal there's no problem with uploading it.
Even the WebRTC standard talks quite a bit about it in the Privacy and Security Considerations section, some quotes:
Revealing IP addresses can leak location and means of connection; this can be sensitive. Depending on the network environment, it can also increase the fingerprinting surface and create persistent cross-origin state that cannot easily be cleared by the user.
[...]
These choices can for instance be made by the application based on whether the user has indicated consent to start a media connection with the other party.
https://w3c.github.io/webrtc-pc/#privacy-and-security-consid...
On standards without additional exposure, this section normally says so and is otherwise empty.
Exposing other visitors IPs is a pretty massive leak (at least some jurisdictions consider them PII, with the consequences to match), presenting that as "no additional privacy exposure" is just negligent (or more likely intentionally misleading).
Privacy: The users IP and more is sent to other users of the website.
Copyright: Content gets distributed by the users computer without his consent. He cannot know if he has been turned into part of a piracy network.
That's not true because you send or receive data from other peers only if you are already watching a video. In other words - p2p is used only in places where the data would have gotten from the server anyways (e.g. p2p didn't add any new users to the equation)
I'm not sure what's your point.
You A are getting content from server S. B is getting the same content from server S.
With this CDN, what changes is that A is now sending content to B. Content that may be illegal. The fact that would mean A was accessing illegal content doesn't change the fact that this CDN moves him from a downloader to an uploader, without his content nor telling him, something that has legal precedent for leading to convictions in europe.