Re: [rtcweb] Proposed text - remote recording use case

["Olle E. Johansson" <[e-mail]>]

12 sep 2011 kl. 10:34 skrev Matthew Kaufman:

> On 9/11/11 10:29 PM, Ravindran Parthasarathi wrote:
>> John,
>> 
>> Please let me know whether the updated text works for you:
>> 
>> New requirements:
>> Fyy1: The browser MUST be able to send in real-time to an another
>> browser/session recording server(SRS) that are being transmitted to and
>> received from remote browser.
>> 
>> Ayy1: The web application MUST be able to ask the browser to transmit in
>> real-time to another browser/session recording server(SRS) that are
>> being transmitted to and received from remote browser.
> 
> I still maintain that adding these requirements opens a huge can of security and resource utilization worms.
> 
> I really think these need to be addressed early before we make this one of the mandatory-to-support cases.

Agree. It will be really hard to include this in the rtcweb architecture as a mandatory-to-support case. 

In the cases where "someone else", i.e. not the browser user, wants to control recording, I assume there will always be a media handling server or gateway where recording can happen anyway. Allowing a third-party to initiate duplication of media streams in the browser has huge security impacts.

/O