Streaming Video Media

[bperquku]

Hi,
I installed Tomcat 6.0. I have sample webapp that streams's video content.
Is it possible some how to protect video from downloading..

Thnx

[Александър Л. Димитров]

Hi,

Quoth bperquku:
> Hi,
> I installed Tomcat 6.0. I have sample webapp that streams's video content.
> Is it possible somke how to protect video from downloading

Simplest suggestion: why don't you just let the webapp authenticate the user
against some user DB? If security isn't a concern there are even simpler methods
(like, md5-hash the password and store it locally).
Query for it with a JS input dialog or an http form. If it's supposed to be very
secure, use SSL on top.

Aleks

[bperquku]

thank you for your reply,
Actually my webapp uses a db authentication, but even registered users will not have to download videos, only to see them.

thnx.

Александър Л. Димитров wrote:

Hi,

Quoth bperquku:
> Hi,
> I installed Tomcat 6.0. I have sample webapp that streams's video content.
> Is it possible somke how to protect video from downloading

Simplest suggestion: why don't you just let the webapp authenticate the user
against some user DB? If security isn't a concern there are even simpler methods
(like, md5-hash the password and store it locally).
Query for it with a JS input dialog or an http form. If it's supposed to be very
secure, use SSL on top.

Aleks

 

[Johnny Kewl]

---------------------------------------------------------------------------
HARBOR: http://coolharbor.100free.com/index.htm
The most powerful application server on earth.
The only real POJO Application Server.
Making the Java dream come true.
---------------------------------------------------------------------------
----- Original Message -----
From: "bperquku" <bperquku@...>
To: <users@...>
Sent: Monday, May 12, 2008 12:48 PM
Subject: Streaming Video Media

Hi bper...
Security always becomes a big subject.
I think in your case you looking for BASIC security, tomcat is just
delivering the file, and you want access control.
Look at this link to get the idea...
http://www.onjava.com/pub/a/onjava/2003/06/25/tomcat_tips.html

Keywords to google for is TOMCAT BASIC authentication
and or DIGEST authentication.

Also look at the embedded help doc in Tomcat... stuff like realms.

Easy once you know how ;)
TC is the best ;)

>
> Hi,
> I installed Tomcat 6.0. I have sample webapp that streams's video content.
> Is it possible somke how to protect video from downloading
> --
> View this message in context:
> http://www.nabble.com/Streaming-Video-Media-tp17185149p17185149.html
> Sent from the Tomcat - User mailing list archive at Nabble.com.
>
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@...
> To unsubscribe, e-mail: users-unsubscribe@...
> For additional commands, e-mail: users-help@...
>
>

---------------------------------------------------------------------
To start a new topic, e-mail: users@...
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Alan Chaney]

My understanding is that you want your users to be able to *view* a
streaming file but not download it to their file system?

Unfortunately there is no way to absolutely prevent this happening,
because the data of the file MUST be transferred from the server to the
browser to allow the end user to watch it.

There is no mechanism in tomcat or any other web server which can
control what the user does with data when they have acutally got it in
their browser.

The best thing that you can do is to try and avoid having the download
link actually appear in the web page. This can be done by for example
having a Flash player to play the video and writing ActionScript to make
a specific request to your server using some kind of obfuscated URL. Of
course, this mechanism will not stop someone with any understanding of
HTTP and HTML from discovering the correct URL to use, but it will stop
people just casually right-clicking on a link and downloading it.

The only other alternative is to employ some kind of DRM system, but I
guess you don't want to go that way.

HTH

Alan Chaney



bperquku wrote:

> thank you for your reply,
> Actually my webapp uses a db authentication, but even registered users will
> not have to download videos, only to see them.
>
> thnx.
>
>
>
> Александър Л. Димитров wrote:
>> Hi,
>>
>> Quoth bperquku:
>>> Hi,
>>> I installed Tomcat 6.0. I have sample webapp that streams's video
>>> content.
>>> Is it possible somke how to protect video from downloading
>> Simplest suggestion: why don't you just let the webapp authenticate the
>> user
>> against some user DB? If security isn't a concern there are even simpler
>> methods
>> (like, md5-hash the password and store it locally).
>> Query for it with a JS input dialog or an http form. If it's supposed to
>> be very
>> secure, use SSL on top.
>>
>> Aleks
>>
>>  
>>
>

---------------------------------------------------------------------
To start a new topic, e-mail: users@...
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[bperquku]

Thanks a lot,

Alan Chaney wrote:

My understanding is that you want your users to be able to *view* a
streaming file but not download it to their file system?

Unfortunately there is no way to absolutely prevent this happening,
because the data of the file MUST be transferred from the server to the
browser to allow the end user to watch it.

There is no mechanism in tomcat or any other web server which can
control what the user does with data when they have acutally got it in
their browser.

The best thing that you can do is to try and avoid having the download
link actually appear in the web page. This can be done by for example
having a Flash player to play the video and writing ActionScript to make
a specific request to your server using some kind of obfuscated URL. Of
course, this mechanism will not stop someone with any understanding of
HTTP and HTML from discovering the correct URL to use, but it will stop
people just casually right-clicking on a link and downloading it.

The only other alternative is to employ some kind of DRM system, but I
guess you don't want to go that way.

HTH

Alan Chaney



bperquku wrote:
> thank you for your reply,
> Actually my webapp uses a db authentication, but even registered users will
> not have to download videos, only to see them.
>
> thnx.
>
>
>
> Александър Л. Димитров wrote:
>> Hi,
>>
>> Quoth bperquku:
>>> Hi,
>>> I installed Tomcat 6.0. I have sample webapp that streams's video
>>> content.
>>> Is it possible somke how to protect video from downloading
>> Simplest suggestion: why don't you just let the webapp authenticate the
>> user
>> against some user DB? If security isn't a concern there are even simpler
>> methods
>> (like, md5-hash the password and store it locally).
>> Query for it with a JS input dialog or an http form. If it's supposed to
>> be very
>> secure, use SSL on top.
>>
>> Aleks
>>
>>  
>>
>

---------------------------------------------------------------------
To start a new topic, e-mail: [e-mail]
To unsubscribe, e-mail: [e-mail]
For additional commands, e-mail: [e-mail]

[Johnny Kewl]

---------------------------------------------------------------------------
HARBOR: http://coolharbor.100free.com/index.htm
The most powerful application server on earth.
The only real POJO Application Server.
Making the Java dream come true.
---------------------------------------------------------------------------
----- Original Message -----
From: "Alan Chaney" <alan@...>
To: "Tomcat Users List" <users@...>
Sent: Monday, May 12, 2008 2:42 PM
Subject: Re: Streaming Video Media


> My understanding is that you want your users to be able to *view* a
> streaming file but not download it to their file system?

Oh I see... something interesting to look at, and its fun (very off topic
though ;)
http://www.youtube.com/watch?v=1uwOL4rB-go

That is not easy to save... little utility I have fails to get this video.
I dont know how they doing it... but it may be a trick the op can use.


---------------------------------------------------------------------
To start a new topic, e-mail: users@...
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Александър Л. Димитров]

Quoth Johnny Kewl:
> Oh I see... something interesting to look at, and its fun (very off topic
> though ;)
> http://www.youtube.com/watch?v=1uwOL4rB-go
>
> That is not easy to save... little utility I have fails to get this video.
> I dont know how they doing it... but it may be a trick the op can use.

Then you should replace your "little utility". There's a nice script in the
Debian repositories, it's called 'youtube-dl'. Command line. Pass it the URL as
an argument and it downloads every YT video. Similar scripts exist for files
stored elsewhere and it's generally not hard to extract video data from flash
streams. If it's on the user's screen it may just as well be on the user's hard
drive.

You can just make it *hard* enough, so that Joe average user won't be able to
store the file. You'll have to live with the black sheep though who will manage
to get around your obfuscation techniques.

Aleks

[Johnny Kewl]

----- Original Message -----
From: "?????????? ?. ????????" <aleks_d@...>
To: "Tomcat Users List" <users@...>
Sent: Monday, May 12, 2008 9:13 PM
Subject: Re: Streaming Video Media

Then you should replace your "little utility". There's a nice script in the
Debian repositories, it's called 'youtube-dl'. Command line. Pass it the URL
as
an argument and it downloads every YT video. Similar scripts exist for files
stored elsewhere and it's generally not hard to extract video data from
flash
streams. If it's on the user's screen it may just as well be on the user's
hard
drive.
You can just make it *hard* enough, so that Joe average user won't be able
to
store the file. You'll have to live with the black sheep though who will
manage
to get around your obfuscation techniques.
Aleks
=========

You totally right, if the data comes to the machine, you gotta be able to
get it.
The rest is just "hassle factor"
but I couldnt figure out what they doing on that page...
I think using ajax to turn an ID into the actual flash address and then
using a bit of javascript to setup the embedded flash.
So I thought stuff this, I cant even find the flash url... I'll just look
for another site.
Found one, found the flash url, pulled it down and its "blank" when it
plays.
So they got me... I must be Joe Ave ;)
No flash expert, but I think they using one flash to load another flash, and
they check something, maybe browser type... they got me ;)
The way I do it works on other flash videos... but not on this one.

Thanks, I will try the 'youtube-dl' util next time ;)

---------------------------------------------------------------------------
HARBOR: http://coolharbor.100free.com/index.htm
The most powerful application server on earth.
The only real POJO Application Server.
Making the Java dream come true.
---------------------------------------------------------------------------


---------------------------------------------------------------------
To start a new topic, e-mail: users@...
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Johnny Kewl]

'youtube-dl'  works... brilliant thanks.
... this is the best mailing list on the web ;)


> You totally right, if the data comes to the machine, you gotta be able to
> get it.
> Thanks, I will try the 'youtube-dl' util next time ;)


---------------------------------------------------------------------
To start a new topic, e-mail: users@...
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Christopher Schultz-2]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Alan,

Alan Chaney wrote:
| The best thing that you can do is to try and avoid having the download
| link actually appear in the web page.

I would also make sure that the Referer [sic] header matches a page that
"contains" the video. Browsers should send that header, while someone
typing the direct-to-video URL would probably not take care to set that
header.

It's not foolproof, but it's as much as is worth doing. Web servers were
designed to serve content. Getting them not to serve content isn't
well-supported :)

- -chris

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkgqLFwACgkQ9CaO5/Lv0PDZTwCgng+pZtK7ebM9Qw0EAtQFroPQ
rPEAn2QTFJEzeuRrFWv9hkcLpSM2SQ5K
=Vz52
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To start a new topic, e-mail: users@...
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[redcoat]

We are developing a website that will likely be hit by up to half a
million users.

Our first concern is obviously performance and scalability, but am
wondering how best to test this?  Most stress tools I've see only simulate
in the order of a thousand users.

Would be grateful for suggestions....

cheers,

David

[Dirk Weigenand]

Hi,

this will likely depend on how much resources you can throw at your performance test tools.

JMeter for instance can work in master/slave mode. So the overall count of simulated users will depend on how much threads your operating system will make available to the jvm running jmeter (of course depending on your test cases) times the hardware you can spend on your tests.

You also want to take into to account the network resources available to you as a limiting factor for your tests.

regards

    Dirk

-------- Original-Nachricht --------
> Datum: Wed, 14 May 2008 16:47:39 -0400
> Von: dhay@...
> An: "Tomcat Users List" <users@...>
> Betreff: Testing performance and scalability

> We are developing a website that will likely be hit by up to half a
> million users.
>
> Our first concern is obviously performance and scalability, but am
> wondering how best to test this?  Most stress tools I've see only simulate
> in the order of a thousand users.
>
> Would be grateful for suggestions....
>
> cheers,
>
> David

--
249 Spiele für nur 1 Preis. Die GMX Spieleflatrate schon ab 9,90 Euro.
Neu: Asterix bei den Olympischen Spielen: http://flat.games.gmx.de

---------------------------------------------------------------------
To start a new topic, e-mail: users@...
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...