undefined | Better HN

0 pointsmdaniel4y ago0 comments

Wowzers, that must make you an impressive attack target for all the session data that gets uploaded to your site. How do you deal with user consent in those cases?

I was curious to see what that experience was like from a client side, but it seems https://newaer.com/ is bombing the .min.js include, which of course doesn't turn on said session capture

BuiltWith alleges you use replay on replay.io but I didn't see any references to it on the main page, and app.replay.io is a white screen due to getInitialTabsState blowing up in src/ui/setup/index.ts

0 comments

3 comments · 1 top-level

acemarke4y ago· 2 in thread

Ah... sorry, not sure I followed all the train of thought there.

The marketing page at https://replay.io is built with Webflow.

The data privacy and security approach is described at https://www.replay.io/security-privacy .

The actual client app at https://app.replay.io is a Next.js app, albeit a fairly complex one:

https://github.com/RecordReplay/devtools

If you're seeing a bug in our client app, could you either try using it again and see if it's fixed now? (Or even better, use the Replay browser to record that error happening, submit it, and file a Github issue with the recording link so we can fix it! Seriously, we dogfood Replay to debug Replay on a daily basis.)

mdanielOP4y ago

I guess your description of the product omitted the "one must use a special build of Firefox" part because when I go to https://app.replay.io with a non-magic browser, it is a white page. However, after downloading your copy of Firefox, it seems to default to app.replay.io and presents a login page

Confusingly, however, clicking on the "Sign in" button launches a link in my system's browser. Fascinating.

> The data privacy and security approach is described at https://www.replay.io/security-privacy

Fine, but my experience with these time traveling session recording frameworks is that they exfiltrate all events to The Cloud, so I wondered how any user of a website that uses that technology would give consent to being monitored in that way. However, after hearing you say "download the browser," maybe that's where the misunderstanding happened

Is it a development time tool, or a sniffer that is designed to be included in a "script" tag on random websites and record all interactions? because those are entirely different threat models

> If you're seeing a bug in our client app, could you either try using it again and see if it's fixed now?

I dunno if "client app" means your rebrand of Firefox, or https://app.replay.io. If the former, well, that's not at all what I was testing. If the latter, no, definitely not fixed

acemarke4y ago

Hmm. Lemme step back and see if I can clarify.

The first step is to make the recording. That does currently require that you download our custom fork of Firefox, which has been instrumented to capture all the OS syscalls. (We also have a Node fork for CI usage, and are working on Chrome for Mac support). In the FF browser, sign in to Replay so it knows who's making the recording. Open the app you want to debug, press the "Record" button, reproduce the issue, and hit "Stop". That uploads the recording data to the cloud. So, no other "script tags" or anything. It's about recording all browser operations as you interact with a given page, while you have the "Record" button active.

The "client" that I'm referring to is https://app.replay.io . This is just a standard web app, and you can use any browser to open that page, log in, and start debugging. (I typically do my dev work in Chrome, personally.) If you're seeing problems with that, I'm very curious what's going on - we've had some backend issues this week, but I haven't seen any reports of client-side bugs.

The data that gets uploaded to the Replay cloud is exactly what _you_ had in the FF browser as you were navigating that page and recording it. So, sure, if you had open a proprietary page, the data from that page is getting uploaded. However, the recording itself is private by default, so only you have access to it, and Replay's client UI will tell you what sorts of domains have data included in the recording as you're looking at it.

Happy to chat more about all this if you'd like. Best place would be to drop by our Discord ( https://replay.io/discord ) - feel free to ping me directly if you do.

j / k navigate · click thread line to collapse