News from Industry

Balázs Kreith of the open-source WebRTC monitoring project, ObserveRTC shows how to calculate WebRTC latency - aka Round Trip Time (RTT) - in p2p scenarios and end-to-end across one or more with SFUs. WebRTC's getStats provides relatively easy access to RTT values, bu using those values in a real-world environment for accurate results is more difficult. He provides a step-by-step guide using some simple Docke examples that compute end-to-end RTT with a single SFU and in cascaded SFU environments.

The post Calculating True End-to-End RTT (Balázs Kreith) appeared first on webrtcHacks.

WebRTC is a building block to be used when developing solutions. Comparing it to solutions is the wrong approach.

[In this list of short articles, I’ll be going over some WebRTC related quotes and try to explain them]

How does WebRTC compare to Zoom?

What about Skype? Or FaceTime?

I’d say this is an to questions – you’re not comparing things that are comparable.

WebRTC is a piece of technology. A set of building blocks that you can use, like lego bricks.

In essence, you can view WebRTC in two ways:

1. A standard specification – what goes on the network. In this mindset, the actual infrastructure pieces are yours to build (=the application/solution), and WebRTC just specifies what goes “in the wire”
2. Open source implementation of the specification – this one is the libwebrtc library maintained by Google and embedded in Chrome. And then it is again just a piece that gets embedded inside different components, usually client-side only. And again, the solution is up to you to build with additional infrastructure pieces

Got an application you’re developing? Need communications sprinkled into it? Some voice. Maybe video. All in real time. And with browser components maybe. If that is the case, then WebRTC is the technology you’re likely to be using for it. But piecing all of that together into your application? That’s up to you. And that’s your solution.

We can then compare the solution you built to some other solution out there.

Next time people tell you “WebRTC isn’t good because it can’t do group calls” – just laugh at their faces. Because as a technology WebRTC can certainly handle group calls and large broadcasts – you’ll need to bring media servers to do that, and sweat to build your solution. The pieces of your puzzle there will include WebRTC as a technology.

Remember:

WebRTC is a technology not a solution. What you end up doing with it is what matters

Looking to learn more on how to use WebRTC technology to build your solution? We’ve got WebRTC training courses just for that!

The post WebRTC is a technology not a solution appeared first on BlogGeek.me.

A full review and guide to all of the Jitsi Meet-related projects, services, and development options including self-install, using meet.jit.si, 8x8.vc, Jitsi as a Service (JaaS), the External iFrame API, lib-jitsi-meet, and the Jitsi React libraries among others.

The post The Ultimate Guide to Jitisi Meet and JaaS appeared first on webrtcHacks.

A very detailed look at the WebRTC implementations of Google Meet and Google Duo and how they compare using webrtc-internals and some reverse engineering.

The post Meet vs. Duo – 2 faces of Google’s WebRTC appeared first on webrtcHacks.

WebRTC requires an ongoing investment that doesn’t lend itself to a one-off outsourced project. You need to plan and work with it longtime.

[In this list of short articles, I’ll be going over some WebRTC related quotes and try to explain them]

WebRTC simplified development and reduced the barrier of entry to many in the market. This brought with it the ability to quickly build, showcase and experiment with demos, proof of concepts and even MVPs. Getting that far is now much easier thanks to WebRTC, but not planning ahead will ruin you.

There are a few reasons why you can’t treat WebRTC as merely a sprint:

1. WebRTC as a technology is changing
   • The standard and what browsers implement isn’t aligned just yet. There are discrepancies, and while they are getting resolved, this takes time, meaning we’re in a long transition period
   • Browsers are investing in WebRTC (or at least the Chrome team is), so browser behaviors wrt WebRTC changes between one Chrome release to another
2. Communications vendors have woken up
   • Since the pandemic, communication vendors are investing heavily in innovation
   • This leads to an arms race in feature sets and capabilities. Things you’ll need to keep up with as well
3. WebRTC is a resource hog
   • It uses microphones and cameras, it eats up CPU and memory
   • New devices (and old devices seen for the first time) may well cause hiccups in your application’s behavior. You’ll be fine tuning, tweaking and troubleshooting your WebRTC code for years to come – assuming your service becomes popular
4. Networks are flaky
   • WebRTC needs to work on unmanaged networks at all times
   • Often enough, users will fail to connect. Or have quality issues. You’ll need to help them out. A lot more than with “simple” web sites

I like using this slide in my courses and presentations:

These are the actors in a WebRTC application. While the application is within your control and ownership – everything else isn’t…

• Users are finicky and they use their own weird devices to connect. They also come with different levels of technical understanding and savviness
• Networks are unmanaged, and you can never know in advance where the user is, if his network is good or bad, and what kind of firewalls and other nasty devices along the route are going to hinder communications
• Browsers don’t adhere to your development schedule. They have their own pace, which is breakneck speeds of around 4 weeks between one release to another

Planning on using WebRTC? Great!

Now prepare for it as you would for a long marathon – it isn’t going to be a sprint.

Things to in your preparation for the WebRTC marathon include:

• Getting skilled teams; most likely growing them inhouse and training them with WebRTC
• Tool up. Take care of long term needs of testing and monitoring (you definitely should check testRTC)
• Use a third party CPaaS to own most of the WebRTC infrastructure headaches if you don’t have the skillset to do it (and yes, I have a report for that)

The post WebRTC is a marathon not a sprint appeared first on BlogGeek.me.

Hearing FUD around WebRTC IP leaks and testing them? The stories behind them are true, but only partially.

WebRTC IP leak tests were popular at some point, and somehow they still are today. Some of it is related to pure FUD while another part of it is important to consider and review. In this article, I’ll try to cover this as much as I can. Without leaking my own private IP address (192.168.123.191 at the moment if you must know) or my public IP address (80.246.138.141, while tethered to my phone at the coffee shop), lets dig into this topic together

Table of contents

• Premier to IP addresses
  • Private and public IP addresses
  • IP addresses and privacy
  • Who knows your IP address(es)?
• WebRTC and IP addresses
• Past WebRTC “exploits” of IP addresses
• Who knows your local IP address in WebRTC?
• VPNs stopping WebRTC IP leaks
• How much should you care about WebRTC IP leaks?
• Do you want privacy or privacy?
• The developer’s angle of WebRTC IP leaks
  • WebRTC application developers
  • VPN developers
• WebRTC leak test: The FAQ version

Premier to IP addresses

IP addresses are what got you here to read this article in the first place. It is used by machines to reach out to each other and communicate. There are different types of IP addresses, and one such grouping is done between private and public addresses.

Private and public IP addresses

Once upon a time, the internet was built on top of IPv4 (and it still mostly is). IPv4 meant that each device had an IP address constructed out of 4 octets – a total of around 4 billion potential addresses. Less than the people on earth today and certainly less than the number of devices that now exist and connect to the internet.

This got solved by splitting the address ranges to private and public ones. A private IP address range is a range that can be reused by different organizations. For example, that private IP address I shared above? 192.168.123.191? It might also be the private IP address you are using as well.

A private IP address is used to communicate between devices that are hosted inside the same local network (LAN). When a device is on a different network, then the local device reaches out to it via the remote device’s public IP address. Where did that public IP address come from?

The public IP address is what a NAT device associates with the private IP address. This is a “box” sitting on the edge of the local network, connecting it to the public internet. It essentially acts as the translator of public IP addresses to private ones.

IP addresses and privacy

So we have IP addresses, which are like… home addresses. They indicate how a device can be reached. If I know your IP address then I know something about you:

• Private IP address is a small window towards that local network. Enough such addresses and someone can get a good understanding of the architecture of that network (or so I am being told)
• Public IP addresses can tell you where that user is. To some extent:

A quick look at that public IP address of mine from above, gives you the following information on WhatIsMyIpAddress.com:

So…

• My ISP is HOT Mobile
• But… this is a cellular hotspot tethered from my smartphone
• And I am definitely not located in Ashdod, although I did grew up there as a kid
• Suffice to say, this isn’t a Static IP address either
• A thing to consider here – a seemingly innocent website knows my public IP address. There’s no real “privacy” in public IP addresses

It is somewhat accurate, but in this specific case, not much. In other cases it can be pretty damn accurate. Which means it is quite private to me.

One thing these nasty IP addresses can be used for? Fingerprinting. This is a process of understanding who I am based on the makeup and behavior of my machine and me. An IP address is one of many characteristics that can be used for fingerprinting.

If you’re not certain if IP addresses are a privacy concern or not, then there’s the notion that most probably IP addresses are considered privately identifiable information – PII (based on ruling of US courts as far as I can glean). This means that an IP address can be used to identify you as a person. How does that affect us? I’d say it depends on the use case and the mode of communications – but what do I know? I am not a lawyer.

Who knows your IP address(es)?

IP addresses are important for communications. They contain some private information in them due to their nature. Who knows my IP addresses anyway?

The obvious answer is your ISP – the vendor providing you access to the internet. It allocated the public IP address you are using to you and it knows which private IP address you are coming from (in many cases, it even assigned that to you through the ADSL or other access device it installed in your home).

Unless you’re trying to hide, all websites you access know your public IP address. When you connected to my blog to read this article, in order to send this piece of content back to you, my server needed to know where to reply to, which means it has your public IP address. Am I storing it and using it elsewhere? Not that I am directly aware of, but my marketing services such as Google Analytics might and probably does make use of your public IP address.

That private IP address of yours though, most websites and cloud services aren’t directly aware of it and usually don’t need it either.

WebRTC and IP addresses

WebRTC does two things differently than most other browser based protocols out there:

1. It enables peer-to-peer communications, directly between two devices. This diverges from the classic client-server approach where a server mediates each and every message between clients
2. WebRTC uses dynamic ports generated per session when needed. This again is something you won’t see elsewhere in web browsers where ports 80 and 443 are so common

Because WebRTC diverges from the client-server approach AND uses dynamic ephemeral ports, there’s a need for NAT traversal mechanisms to be able to.., well… pass through these NATs and firewalls. And while at it, try not to waste too much network resources. This is why a normal peer connection in WebRTC will have 4+ types of “local” addresses as its candidates for such communications:

1. The local address (usually, the private IP address of the device)
2. Server reflexive address (the public IP address received via a STUN request)
3. Host address (a public IP address received via a TURN request). This one comes in 3 different “flavors”: UDP, TCP and TLS

Lots and lots of addresses that need to be communicated from one peer to another. And then negotiated and checked for connectivity using ICE.

Then there’s this minor extra “inconvenience” that all these IP addresses are conveyed in SDP which is given to the application on top of WebRTC for it to send over the network. This is akin to me sending a letter, letting the post office read it just before it closes the envelope.

IP addresses are necessary for WebRTC (and VoIP) to be able to negotiate and communicate properly.

This one is important, so I’ll write it again: IP addresses are necessary for WebRTC (and VoIP) to be able to negotiate and communicate properly.

It means that this isn’t a bug or a security breach on behalf of WebRTC, but rather its normal behavior which lets you communicate in the first place. No IP addresses? No communications.

One last thing: You can hide a user’s local IP address and even public IP address. Doing that though means the communication goes through an intermediary TURN server.

Past WebRTC “exploits” of IP addresses

WebRTC is a great avenue for hackers:

1. It is a new piece of technology, so the understanding of it is limited
2. WebRTC is complex, with a lot of different network protocols and attack surfaces via its extensive APIs
3. IP addresses are needed to be exchanged, giving access to… well… IP addresses

The main exploits around IP addresses in browsers affecting the user’s privacy were conducted so far for fingerprinting.

Fingerprinting is the act of figuring out who a user is based on the digital fingerprint he leaves on the web. You can glean quite a lot about who a user is based on the behavior of their web browser. Fingerprinting makes users identifiable and trackable when they browse the web, which is quite useful for advertisers.

The leading story here? NY Times used WebRTC for fingerprinting

There’s a flip side to it – WebRTC is/was a useful way of knowing if someone is a real person or a bot running on browser automation as indicated in the comments. A lot of the high scale browser automations simply couldn’t quite cope with WebRTC APIs in the browser, so it made sense to use it as part of the techniques to ferret out real traffic from bots.

Since then, WebRTC made some changes to the exposure of IP addresses:

• It doesn’t expose local IP addresses to the application if the user haven’t allowed access to the camera or microphone
• If it still needs local addresses, it uses mDNS instead

Who knows your local IP address in WebRTC?

There are different entities in a WebRTC session that need to have your local IP address in a WebRTC session:

1. Your browser. Its “innards” which runs the WebRTC stack needs to know your local IP address. And it does. So does your browser for that matter
2. The other peer. This can be another web browser or a media server. They need that IP address to reach back to you if they’re on the same network as you are. And they can only know that if they try reaching out to you
3. The web application. Since WebRTC has no signaling, the application is the one that sends the local IP address to the other peer
4. Browser extensions. These may have access to this information simply because they have JavaScript coding access to the web page conducting the communications. Since the web application has a clear view of the IP addresses in the SDP messages, so does any browser extensions that have access to that web page and web application
5. TURN servers. Not yours, but your peer’s TURN server. Since that TURN server may act as a mediator for the traffic. It needs your local IP address to try (and mostly fail) to connect to it

The other peer, the web application and the TURN server don’t really need that access if you don’t care about the local network connectivity use case. If connecting a WebRTC session on the local network (inside a company office, home, etc) isn’t what you’re focused on, then you should be fine with not sharing the local IP address.

Also, if you are concerned about your privacy to the point of not wanting people to know your local IP address – or public IP address – then you wouldn’t want these IP addresses exposed either.

But how can the browser or the application know about that?

VPNs stopping WebRTC IP leaks

When using a VPN, what you are practically doing is making sure all traffic gets funneled through the VPN. There are many reasons for using a VPN and they all revolve around privacy and security – either of the user or the corporate whose VPN is being used.

The VPN client intercepts all outgoing traffic from a device and routes it through the VPN server. VPNs also configure proxy servers for that purpose so that web traffic in general would go through that proxy and not directly to the destination – all that in order to hide the user itself or to monitor the user’s browsing history (do you see how all these technologies can be used either for anonymity or for the exact opposite of it?).

WebRTC poses a challenge for VPNs as well:

• It uses multiple addresses and ports. Dynamically. So it is a bit harder to track and reroute
• IP addresses are found inside the body of HTTP and WebSocket messages themselves and not only in the protocol headers. They can be quite hard to find in order to delete/replace
• WebRTC uses UDP, which typically doesn’t get a special treatment by web proxies (which tend to focus on HTTP and WebSocket traffic)
• Did I mention it is rather new? And VPN vendors know little about it

To make all this go away, browsers have privacy policies built into them. And VPNs can modify these policies to accommodate for their needs – things like not allowing non-proxied UDP traffic to occur.

How much should you care about WebRTC IP leaks?

That’s for you to decide.

As a user, I don’t care much about who knows my IP address. But I am not an example – I am also using Chrome and Google services. Along with a subscription to Office 365 and a Facebook account. Most of my life has already been given away to corporate America.

Here are a few rules of thumb I’d use if I were to decide if I care:

• If you’re blocking JavaScript in your browser then you probably have nothing to worry about – WebRTC won’t work without it anyway
• Assuming you’re not using Skype, Facebook Messenger, Whatsapp and others because you don’t want them to know or track you, then you should think twice about using WebRTC as well. And if you use it, make sure to “plug” that “IP leak” in WebRTC
• Using a VPN? Then it means you don’t want your IP addresses publicly known. Make sure your VPN handles WebRTC properly as well
• You replaced Google Search with DuckDuckGo in your browser? Or other search engines because they were said to be more privacy conscious? Then you might want to consider the WebRTC angle of it as well

In all other cases, just do nothing and feel free to continue using WebRTC “as is”. The majority of web users are doing just that as well.

Do you want privacy or privacy?

This one is tricky

You want to communicate with someone online. Without them knowing your private or public IP address directly. Because… well… dating. And anonymity. And harassment. And whatever.

To that end, you want the communication to be masked by a server. All of the traffic – signaling and media – gets routed through the intermediary server/service. So that you are masked from the other peer. But guess what – that means your private and public IP addresses are going to be known to the intermediary server/service.

You want to communicate with someone online. Without people, companies or governments eavesdropping on the conversation.

To that end, you want the communication to be peer-to-peer. No TURN servers or media servers as intermediaries. Which is great, but guess what – that means your private and public IP addresses are going to be known to the peer you are communicating with.

At some point, someone needs to know your IP addresses if you want and need to communicate. Which is exactly where we started from.

Oh, and complicated schemes a-la TOR networking is nice, but doesn’t work that well with real time communications where latency and bitrates are critical for media quality.

The developer’s angle of WebRTC IP leaks

We’ve seen the issue, the reasons for it and we’ve discussed the user’s angle here. But what about developers? What should they do about this?

WebRTC application developers

If you are a WebRTC application developer, then you should take into account that some of your users will be privacy conscious. That may include the way they think about their IP addresses.

Here are a few things for you to think about here:

• Does your service offer P2P communications? (you probably need local IP addresses for that in the messages)
• If your traffic flows solely via media servers, consider removing host candidates from the device side. They will be mostly useless anyway
• You’re probably passing the IP addresses in SDP messages in your network. Are you storing them or logging them anywhere? For how long? In what format?
• Test your service in various privacy-challenging environments:
  • Web proxies
  • Strict firewalls
  • VPNs of various types

VPN developers

If you are a VPN developer, you should know more about WebRTC, and put some effort into handling it.

Blocking WebRTC altogether won’t solve the problem – it will just aggravate users who need access to WebRTC-based applications (=almost all meeting apps).

Instead, you should make sure that part of your VPN client application takes care of the browser configurations to place them in a policy that fits your rules:

• Make sure you route WebRTC traffic via the VPN. That includes both signaling (easy) and media (harder). I’d also check the data channel routing while at it if I were you
• Handle UDP routing. Don’t just go for the simple TCP/TLS-only approach, as this will ruin the quality of experience for your users
• Test against multiple different types of WebRTC applications out there. Don’t only look at Google Meet – there are plenty of others people are using

WebRTC leak test: The FAQ version What is a WebRTC leak test?

A WebRTC leak test is a simple web application that tries to find your local IP address. This is used to check and prove that an innocent-looking web application with no special permissions from a user can gain access to such data.

Does WebRTC still leak IP?

Yes and no.
It really depends where you’re looking at this issue.
WebRTC needs IP addresses to communicate properly. So there’s no real leak. Applications written poorly may leak such IP addresses unintentionally. A VPN application may be implemented poorly so as to not plug this “leak” for the privacy conscious users who use them.

Can I block WebRTC leaks in Chrome?

Yes. By changing the privacy policy in Chrome. This is something that VPNs can do as well (and should do).

How severe is the WebRTC leak?

The WebRTC leak of IP addresses gives web applications the ability to know your private IP address. This has been a privacy issue in the past. Today, to gain access to that information, web applications must first ask the user for consent to access his microphone or camera, so this is less of an issue.

What is a good VPN to plug the WebRTC leak?

I can’t really recommend a good VPN to plug WebRTC leaks. This isn’t what I do, and frankly, I don’t believe in such tools plugging these leaks.
One rule of thumb I can give here is that don’t go for a free VPN. If it is free, then you are the product, which means they sell your data – the exact privacy you are trying to protect.

The post What is the WebRTC leak test and should you be worried about it? appeared first on BlogGeek.me.

Step-by-step guide on how to fix bad webcam lighting in your WebRTC app with standard JavaScript API's for camera exposure or natively with uvc drivers.

The post Fix Bad Lighting with JavaScript Webcam Exposure Controls (Sebastian Schmid) appeared first on webrtcHacks.

What WebRTC did to VoIP was reduce the barrier of entry to new vendors and increased the level and domains of innovation.

[In this list of short articles, I’ll be going over some WebRTC related quotes and try to explain them]

WebRTC was an aha moment in the history of communications.

It did two simple things that were never before possible for “us” VoIP developers:

1. Offered a built-in implementation in the browser (you mostly no longer needed to implement the low level media processing aspect of the client device)
2. Provided in single, standardized API layer (up until then the standardized layer was the network protocol itself)

This in turn, brought with it the two aspects of WebRTC illustrated above:

1. Reduced barrier of entry
   • You no longer needed to know in detail how the network protocols worked in order to develop something – there’s a standardized API that you can use that takes care of handling all that networking “stuff” somewhere (or at least needed to know a lot less to get started and to launch something)
   • The client side was mostly solved on the low level. You could focus on building your application and user experience a lot earlier in the game
2. Increased innovation
   • Now that you’re not expected to focus so much on the low level, you can work more on the user experience, which means more time to innovate
   • And since you don’t need to know all of that networking stuff so intimately, you no longer need to be “indoctrinated” as a VoIP developer. Which means developers came from all software domains, with their own ideas on how communications should work, forcing greater innovate than ever before

For many years I’ve been using this slide to explain why WebRTC is so vastly different than what came before it:

• It is free since the code is open source and the implementation is already embedded in all modern browsers. This means everyone can make use of it → reduced barrier of entry
• The focus of it is web developers and not VoIP developers. There are more web developers than VoIP ones, and they come with different worldviews → increased innovation

That said, truly innovating, productizing and scaling WebRTC applications require a bit more of an investment and a lot more in understanding and truly grokking WebRTC. Especially since WebRTC is… well… it is web and VoIP while at the same time it isn’t exactly web and it isn’t exactly VoIP:

This means that you need to understand and be proficient with both VoIP development (to some extent) and with web development (to some extent).

Looking to learn WebRTC? Here are some guidelines of how to get started with learning WebRTC.

The post WebRTC reduced barriers and increased innovation in communications appeared first on BlogGeek.me.

With FIDO coming to replace passwords in applications, CPaaS vendors are likely to decline in 2FA revenues.

2FA revenue has always lived on the premise that passwords are broken. I’ve written about this back in 2017:

Companies are using SMS for three types of services these days:

1. Security — either through two-factor authentication (2FA), for signing in to services; or one-time password (OTP), which replaces the need to remember a password for various apps

2. Notifications for services — these would be notifications that you care about or that offer you information, like that request for feedback or maybe that birthday coupon

3. Pure spam — businesses just send you their unsolicited crap trying to get you to sign up for their services

Spam is spam. Notifications are moving towards conversations on social networks. And the security SMS messages are going to be replaced by FIDO. Here’s where we’re headed.

Let’s take this step by step.

Table of contents

• Passwords and the FIDO Alliance
• 2FA: a CPaaS milking cow
• The death of 2FA
• The future of CPaaS

Passwords and the FIDO Alliance

Passwords are the bane of our modern existence. A necessary evil.

To do anything meaningful online (besides reading this superb article), you need to login or identify yourself against the service. Usually, this is done by a username (email or an identity number most likely) and a password. That password part is a challenge:

• It needs to be something you remember (=know)
• But you can’t use it on more than one site. If you do, and that site is hacked, then your data on other sites is going to be exposed
• And that password needs to be non-simple. So it can’t be easily guessed
• So 8 characters or more. Upper and lower case. A digit or two or three please. Maybe a special character to boot
• Oh – and please change it every 3 or 6 months because… security

I use a password manager to handle my online life. My wife uses the “forgot my password” link all the time to get the same results.

It seems that whatever was tried in the passwords industry has failed in one way or another. Getting people house trained on good password practices is just too damn hard and bound to failure (just like trying to explain to people not to throw facial tissue down the toilet).

Experts have since pushing for a security model that authenticates a user with multiple “things”:

1. Something you know (=password)
2. Something you own (=smartphone or security key)
3. Something you are (=biometrics)

Smartphones today are something you own and they offer something you are by having fingerprint ID and face ID solutions baked into them. That last piece is the password.

Enter FIDO.

FIDO stands for Fast IDentity Online.

Here’s the main marketing spiel of the FIDO Alliance:

The FIDO Alliance seems to have more members than it has views on that YouTube video (seriously).

By their own words:

The FIDO Alliance is working to change the nature of authentication with open standards that are more secure than passwords and SMS OTPs, simpler for consumers to use, and easier for service providers to deploy and manage.

So:

• Open standards
• More secure than passwords and SMS OTPs
• Simpler for consumers to use
• Easier to deploy and manage

What more can you ask for?

Well… for this standard to succeed.

And here is what brought me to write this article. The recent announcement from earlier this month – Apple, Google and Microsoft all committing to the FIDO standard. They are already part of FIDO, but now it is about offering easier mechanisms to remove the need for a password altogether.

If you are reading this, then you are doing that in front of an Apple device (iPhone, iPad or MacOS), a Google one (Android or Chrome OS) or a Microsoft one (Windows). There are stragglers using Linux or others, but these are tech-savvy enough to use passwords anyways.

These devices are more and more active as both something you own and something you are. My two recent laptops offer fingerprint biometric identification and most (all?) smartphones today offer the same or better approaches as well.

I long waited for Google and Apple to open up their authentication mechanisms in Android and iOS to let developers use it the same way end users use it to access Google and Apple services – when I login to any Google connected site anywhere, my smartphone asks me if that was me.

And now it seems to be here. From the press release itself:

Today’s announcement extends these platform implementations to give users two new capabilities for more seamless and secure passwordless sign-ins: 

1. Allow users to automatically access their FIDO sign-in credentials (referred to by some as a “passkey”) on many of their devices, even new ones, without having to re-enroll every account. 

2. Enable users to use FIDO authentication on their mobile device to sign in to an app or website on a nearby device, regardless of the OS platform or browser they are running.

So… no need for passwords. And no need for 2FA. Or OTP.

FIDO is going to end the farce of using 2FA and OTP technologies.

2FA: a CPaaS milking cow

2FA stands for Two Factor Authentication while OTP stands for One Time Password.

With 2FA, you enter your credentials and then receive an SMS or email (or more recently Whatsapp message) with a number. You have to paste that number on the web page or app to login. This adds the something you own part to the security mechanism.

OTP is used to remove the password altogether. Tell us your email and we will send you a one time password over SMS (or email), usually a few digits, and you use that to login for just this once.

2FA, OTP… the ugly truth is that it is nagging as hell to everyone. Not only users but also application developers. The devil is always in the details with these things:

• How do you send an SMS message?
• What happens if the SMS or email isn’t received? Is there a retry mechanism?
• Can the user complain if it doesn’t work to get things resolved?
• Who takes care of internationalization of these messages?
• …

The list goes on. So CPaaS vendors have gone ahead and incorporated 2FA specific solutions into their bag of services. Twilio even acquired Authy in 2015, a customer, just to have that in their offerings at the time.

The great thing about 2FA (for CPaaS vendors), is that the more people engage with the digital world, the more they will end up with a 2FA or OTP SMS message. And each such message is a minor goldmine: A single SMS on Twilio in the US costs $0.0075 to send. A 2FA transaction will cost an additional $0.09 on top of it.

Yes. 2FA services bring great value. And they are tricky to implement and maintain properly at scale. So the price can be explained. But… what if we didn’t really need 2FA at all?

The death of 2FA

Putting one and one together:

Apple, Google and Microsoft committing to FIDO and banishing passwords by making their devices take care of something you know, something you own AND something you are means that users will not need to identify themselves in front of services using passwords AND they won’t be needing OTP or 2FA either.

The solution ends up being simpler for the user AND simpler for the service provider.

Win Win.

Unless you are a CPaaS vendor who makes revenue from 2FA. Then it is pure loss.

What alternatives can CPaaS vendors offer?

At first step, the “migration” from “legacy” 2FA and OTP towards Apple/Google’s new and upcoming FIDO solution. Maybe a unified API on top of Apple and Google, but that’s a stretch. I can’t see such APIs costing $0.09 per authentication. Especially if Apple and Google do a good job at the developer tooling level for this.

* I removed Microsoft closer to the end here because they are less important for this to succeed. They are significant if this does succeed in making it even simpler on laptops so one won’t have to reach for his phone to login when on a laptop.

The future of CPaaS

5 years ago, back in that 2017 article, I ended it with these words:

Goodbye SMS, It’s Time for Us to Move On

Don’t be fooled by the growth of 2FA and application-to-person (A2P) type messages over SMS. This will have a short lifespan of a few years. But five to 10 years from now? It will just be a service sitting next to my imaginary fax machine.

We’re 5 years in and the replacements of SMS are here already.

• Social truly is starting to replace SMS notifications with long lived conversations, augmented with the surge of chatbots everywhere
• 2FA and OTP are now threatened by FIDO to be replaced simply by the fact that you own a smartphone

All that revenue coming to CPaaS from SMS is going to go elsewhere. Social omnichannel introduced by CPaaS vendors will replace that first chunk of revenue, but what will replace the 2FA and OTP? Can CPaaS vendors rely on FIDO and build their own business logic on top and around it for their customers?

It seems to me revenue will need to be found elsewhere.

Interested in learning more about the future of CPaaS? Check out my ebook on the topic (relevant today as it was at the time of writing it).

Download my CPaaS in 2020 ebook

The post FIDO Alliance and the end of 2FA revenue to CPaaS vendors appeared first on BlogGeek.me.

Saúl Ibarra Corretgé of Jitsi walks through his epic struggle getting Apple iOS bitcode building with WebRTC for his Apple Watch app.

The post The WebRTC Bitcode Soap Opera (Saúl Ibarra Corretgé) appeared first on webrtcHacks.

What was nice to have is now becoming mandatory in WebRTC video calling applications. This includes background blurring, but also a lot of other features as well.

Do you remember that time not long ago that 16 participants on a call was the highest number that product managers asked for? Well… we’re not there anymore. In many cases, the number has grown. First to 49. Then to a lot more, with nuances on what exactly does it mean to have larger calls. We now see anywhere between 100 to 10,000 to be considered a “meeting”.

I’ve been talking and mentioning table stakes for quite some time – during my workshops, on my messages on LinkedIn, in WebRTC Insights. It was time I sat down to write it on my blog

Table of contents

• WebRTC table stakes
• Background blurring/replacement
• Video lighting
• Noise suppression/cancellation
• Speech to text
• WebRTC meeting size
• Getting there requires WebAssembly and constant optimization

WebRTC table stakes

This isn’t really about WebRTC, but rather what users now expect from WebRTC applications. These expectations are in many cases table stakes – features that are almost mandatory in order to be even considered as a relevant vendor in the selection process.

What you’ll see here is almost the new shopping list. Since users are different, markets are different, scenarios are different and requirements vary – you may not need all of them in your application. That said, I suggest you take a good look at them, decide which ones you need tomorrow, which you don’t need and which you have to get done yesterday.

Background blurring/replacement

Obvious. I have a background replacement. I never use it in my own calls. Because… well… I like my background. Or more accurately – I like showing my environment to people. It gives context and I think makes me more human.

This isn’t to say people shouldn’t use background replacement or that I’ll hate them for doing that – just that for me, and my background – I like keeping the original.

Others, though, want to replace their background. Sometimes because they don’t have a proper place where the background isn’t cluttered or “noisy”. Or because they just want to have fun with it.

Whatever the reason is, background blurring and replacement are now table stakes – if your app doesn’t have it, then the app that does in your market will be more interesting and relevant to the buyers.

Here’s how I see the development of the requirements here:

• Figure out where a user is. Here, you can even implement an auto zoom capability (many skip this, though this can be quite useful as well)
• Then focus on background blurring. It is the most tolerant of the alternatives
• Move on to background replacement. Replace the background with a static image
• Go for video backgrounds, where the user can replace the background with something moving
• Think of “teleporting” the user after you’ve cut him away from his background to place him directly on a slide deck or in a virtual environment

Video lighting

If I recall correctly, Google Meet started with this feature, and since then it started cropping into other meeting solutions. We all use webcams, but none of us has good lighting. It might be a window behind (or in my case to the side), the weather out the window, the hour in the day, or just poor lighting in the room.

While this can be fixed, it isn’t. Much like the cluttered room, the understanding is that humans are lazy or just not up to the task of understanding what to do to improve video lighting on their own. And just like background removal, we can employ machine learning to improve lighting on a video stream.

Noise suppression/cancellation

I started using this stock image when I started doing virtual workshops. It is how I like to think of my nice neighbor (truth be told – he really is nice). It just seems that every time I sit down for an important meeting, he’d be on one of his renovation sprees.

The environment in which we’re conducting our calls is “polluted” with sounds. My mornings are full with lawn mower noises from the park below my apartment building. The rest of my days from the other family members in my apartment and by my friendly neighbor. For others, it is the classic dog barking and traffic noises.

Same as with video, since we’re now doing these sessions from everywhere at any time, it is becoming more important than ever to have this capability built into the service used.

Some services today offer the ability to suppress and cancel different types of noises. You don’t have the control over what to suppress, but rather get an on/off switch.

Four important things here:

1. What noises are suppressed isn’t obvious. Each vendor picks and chooses what seems fit to his use case
2. This can be implemented either on the sender side or on the receiver side or both
3. It can be implemented on the device or in the cloud. Google Meet for example does that in the cloud while many others do it on the device
4. Unlike the video features we’ve seen before, here as the sender, you can’t really hear what’s being suppressed of your end of the call…

And last but not least, this is a kind of a feature that can also be implemented directly by the microphone, CPU or operating system. Apple tried that recently in iOS and then reverted back.

Speech to text

Up until now, we’ve discussed capabilities that necessitated media processing and machine learning. Speech to text is different.

For several years now we’ve been hammered around speech to text and text to speech. The discussion was usually around the accuracy of the algorithms for speech to text and the speed at which they did their work.

It now seems that many services are starting to offer speech to text and its derivatives baked directly into their user experience. There are several benefits of investing in this direction:

• Switching to text enables us to process the meeting for its meaning. Usually in the form of extracting meeting minutes and action items
• Speech to text means we can get a transcript of a meeting, making it searchable
• Accessibility – doing so in real-time, means we can transcribe the meeting to the participants, assisting them with noisy environments of other participants or simply with understanding accents – my company, testRTC, was acquired by Spearline, an Irish vendor – I am just getting used to understanding their accent
• This is a step necessary for translation

The challenges with speech to text is first on how to pass the media stream to the speech to text algorithm – not a trivial task in many cases; and later, picking a service that would yield the desired results. 

WebRTC meeting size

It used to be 9 tiles. Then when the pandemic hit, everyone scrambled to do 49 gallery view. I think that requirement has become less of an issue, while at the same time we see a push towards a greater number of participants in sessions.

How does that work exactly?

• The assumption that everyone is seen, needs to be seen or wants to be seen is not realistic in many scenarios
• Meetings are mostly asymmetric in nature. Not everyone has the same level of participation, and oftentimes, we aren’t aware of this in advance
• Quarantines and later remote work got us to the point where a lot more media streams join a meeting:

If in the past we had a few meeting rooms joining in to a meeting, with a few people seated in each room, now most of the time, we will have these people join in remotely from different locations. The number of people stayed the same, yet the number of media streams grew.

We’re also looking to get into more complex scenarios, such as large scale virtual events and webinars. And we want to make these more interactive. This pushes the boundary of a meeting size from hundreds of participants to thousands of participants.

This requirement means we need to put more effort into implementing optimizations in our WebRTC architecture and to employ capabilities that offer greater flexibility from our media servers and client code.

Getting there requires WebAssembly and constant optimization

These new requirements and capabilities are becoming table stakes. Implementing them has its set of nuances, and each of these features is also eating up on our CPU and memory budget.

It used to be that we had to focus on the new shiny toys. Adding new cool features and making them available on the latest and greatest devices. Now it seems that we’re in need of pushing these capabilities into ever lower performing devices:

• Older PCs and laptops, to deal with the majority of the population and not only early adopters and tech savvy users
• Plethora of peripherals – headsets, mics, speakers and webcams – all with their own quirks and proprietary features (echo canceling, latency inducing bluetooth headsets anyone?)

So we now have less capable devices who need more features to work well, requiring us to reduce our CPU requirements to serve them. And did I mention most of these new table stakes need machine learning?

The tool available to us for all this is WebAssembly on the browser side. This enables us to run code faster in the browser and implement algorithms that would be impossible to achieve using Javascript.

It also means we need to constantly optimize the implementation, improving performance to make room for more of these algorithms to run.

10 years into WebRTC and 2 years into the pandemic, we’re only just scratching the surface of what is needed. How are you planning to deal with these new table stakes?

The post WebRTC video calling table stakes appeared first on BlogGeek.me.

Anycast enables WebRTC services to better manage and optimize global deployments at scale.

In 2021 we’ve started seeing a new technology finding its way more and more into WebRTC applications: Anycast. Unlike other shiny new toys, Anycast isn’t shiny and it isn’t new. In fact, it has been defined in the previous millenia, before the era of the smartphone.

I’ve been “doing” VoIP for over 20 years now, but wasn’t really aware of Anycast. I dug a bit around, and ended up sitting with William King, CTO & Co-founder of Subspace, to learn more about AnyCast and its use with WebRTC.

Here’s what I learned about how WebRTC developers can and are using Anycast – and how it can assist them in their own deployments.

Table of contents

• What is Anycast anyway?
• Challenges of using Anycast in WebRTC
• 3 advantages of Anycast for WebRTC
  • #1 – Better geolocation
  • #2 – Higher resiliency (and security)
  • #3 – Ease of configuration
• Is Anycast in the future of WebRTC?

What is Anycast anyway?

For someone sitting in the clouds today, the lowest level of networking you can think of is the IP level (I am told there are lower levels, but for me IP is low enough).

At that level, if one machine wants to reach another, it needs to use its IP address as the destination. In most cases, and at least in 99% of all of the things I’ve implemented myself as a developer, you do this using what is known as Unicast:

With Unicast, each device on the network has its own unique IP address that I can use to reach it directly (and yes, I am ignoring here the distinction between local networks and public networks and how they handle it). The key thing here is that an IP address is associated with one device only, so as the illustration above shows, when the red device wants to send a message to the green device, it can send it to him via Unicast simply by stating the green device’s IP address as the destination.

Anycast is different. With Anycast, multiple devices on the network can have the same IP address associated with them. The end result is more akin to this:

In the illustration above we have 3 different green devices with the same IP address. When the red device wants to send a message to their IP address, it doesn’t really know which one will be receiving his message – just that it is somehow going to be routed to one of them. Which one? The “closest” one usually, whatever that means.

What does that mean exactly?

Here’s how Wikipedia explains it (the illustrations above are rough sketches I did based on the ones I found on their page explaining Anycast):

Anycast is a network addressing and routing methodology in which a single destination IP address is shared by devices (generally servers) in multiple locations. Routers direct packets addressed to this destination to the location nearest the sender, using their normal decision-making algorithms, typically the lowest number of BGP network hops. Anycast routing is widely used by content delivery networks such as web and DNS hosts, to bring their content closer to end users.

Lets emphasize this with colors, so we focus on the important bits –

1. We get a single IP address that can be shared between multiple devices in different locations
2. When we send a message to that IP address, it will get routed to the nearest device
3. The decision is done lower in the network layers
4. It is popular with CDNs and DNS hosts

Anycast is something that is being widely used today, just not in VoIP or WebRTC.

The main purpose of Anycast at the end of the day is to provide high availability for stateless services.

• Why high availability? Because we have multiple devices with the same IP address. If one goes down, messages get routed to other servers. Magically.
• For stateless services? Since we don’t know and can’t guarantee which device each message is going to be routed to, it is simpler to use it for stateless services.

Challenges of using Anycast in WebRTC

The best thing you can do with Anycast is to deal with single request-response pairs – stateless.

Why? You send out your request (for example to translate a DNS name to an IP address; or for that next chunk of a Netflix episode you’re watching), and the server (device) you reach on the network sends you that response.

Looking for the next chunk in the Netflix episode or need another DNS name translation? Easy – send another request, and the same or another server with the same Anycast IP address will respond.

Enter WebRTC.

A world where everything and anything is stateful.

There’s signaling. With its connection state machine, ICE negotiation state machine (see? State Machine hints of this not being stateless) and application logic on top.

Then there are TURN servers and media servers. All of them need to understand the state and manage incoming media flow that is both stateful and real time.

This makes utilizing Anycast in WebRTC quite a challenge.

While we’d like to enjoy Anycast’s obvious advantage of high availability (and a few other advantages it gives), in order to do so, we need to overcome the statefulness challenge first.

The simplest link in WebRTC is the TURN server. While stateful, its job is rather simple – routing data between peers without much thought. This makes TURN servers the best candidate for infrastructure optimizations using Anycast.

Lets see what advantages Anycast TURN infrastructure can give WebRTC applications.

3 advantages of Anycast for WebRTC

Once you get down to it, deploying TURN servers and maybe even media servers using Anycast can give some interesting benefits to your infrastructure.

Here are the main advantages – ones that are going to define how WebRTC infrastructure will be designed and deployed in the coming years.

#1 – Better geolocation

When a user connects your WebRTC application, your best bet is to make sure the user is as close to your infrastructure as possible. The fastest you put him on a TURN or a media server, the better media quality you can expect.

Why? Simple. Because from that server the user connected to – you control and own the media flow of the server. And if you control and own it you can make it better. But that part of the journey the media does from the user to your first server? That’s something you don’t control and own so your ability to improve quality there is lower.

This is why whenever a user joins, you are likely to start doing some geolocation, trying to figure out where the user is coming from in order to allocate for him your “closest” TURN or media server.

That process is done usually by looking at the origin IP address and then using a third party service to indicate the location of that IP address – or by DNS geolocation – letting a DNS server do that for us somehow. When we leave it to the DNS, then we are at the mercy of the DNS service hosting. It works, but not always. And it is also somewhat slow to update.

Remember that time you changed the DNS configuration of your WordPress server? Were you told it can take a few hours to “propagate”? Well… that’s exactly the problem you might be facing in getting routes updated when using DNS geolocation.

With Anycast, geolocation takes place at the BGP level. Don’t ask me what that is exactly, but it means two things for us:

1. Changes and updates propagate faster. I was told by Subspace that their network fully updates within 30 seconds of a change taking place
2. You (our the one providing you WebRTC servers with Anycast) are in control and ownership of these routes and their optimization.

That second point is a big difference. DNS servers have different “job to be done” than WebRTC Anycast services. The latter focuses on real time delivery and on better and more optimized geolocation as an extension of it. So you can expect better results overall, especially on a global scale.

#2 – Higher resiliency (and security)

To operate an Anycast service requires solving the statelessness challenge it when it comes to WebRTC. Once that is solved, we gain the benefit of having our data routed through the closest server over the IP layer.

If the physical server we’re working in front of goes down, then Anycast will reroute future traffic through other servers with the same IP address. And that gives us a natural resiliency.

Furthermore, assume I am an “adversary” that wants to take down your service or disrupt it.

I can check the IP addresses you are using and map your servers. I can then commence with a DDoS attack to flood one or more of your servers via these IP addresses.

If that IP address belongs to a specific server, it will require a relatively small amount of traffic to bring that server down to its knees. But if that IP address belongs to multiple servers via Anycast, then flooding that IP address means trying to flood the whole network and not a specific server – a much harder task to achieve.

Resiliency comes built-in with Anycast.

#3 – Ease of configuration

The ease of configuration is something you get from the first two advantages.

Once we’re using Anycast, then there are a few things that make our lives easier:

• The whole GeoDNS operations we’re doing is done on a lower level for us via Anycast, and the higher application layers can remain uninvolved
• If a routing change is needed, then the change takes effect a lot faster, giving us better feedback loops of the changes we’re making
• With a single IP address we can have less addresses given to customers who need to configure their firewalls accordingly – our list of IPs are simpler and shorter
• Since we are more resilient by design, then decommissioning servers, upgrading them, replacing them or whatever – is easier to deal with, since existing traffic is less affected

Is Anycast in the future of WebRTC?

Anycast is where much of the future of WebRTC services lies.

We are shifting our focus on how to optimize and maintain WebRTC infrastructure at scale. Last year it was all about getting to that 49-grid gallery view. This year it is a lot more nuanced. It is mostly about scale, performance and global reach as far as I can tell.

Anycast can play a vital role in that area and in how services can improve their performance and perceived quality for their users.

The post 3 advantages of Anycast in WebRTC you didn’t know about appeared first on BlogGeek.me.

RTC@Scale was Facebook’s virtual WebRTC event, covering current and future topics. Here’s the summary so you can pick and choose the relevant ones for you.

WebRTC Insights is a subscription service I have been running with Philipp Hancke for over a year now. The purpose of it is to make it easier for developers to get a grip of WebRTC and all of the changes happening in the code and browsers – to keep you up to date so you can focus on what you need to do best – build awesome applications.

We got into a kind of a flow:

• Once every two weeks we finalize and publish a newsletter issue
• Once a month we record a video summarizing libwebrtc release notes

It is fun to do and the feedback we’re getting is positive.

That said, being us, means that we can’t really sit still… or in this case – Philipp…

We published this on Monday the week after the event took place to our WebRTC Insights clients, and now, we’re opening it up for everyone as well.

Table of contents

• Why an RTC@Scale summary?
• KEYNOTE, PANEL AND WRAP-UP
• SESSION 1: FUTURE RTC EXPERIENCES
• SESSION 2: AUDIO ML
• SESSION 3: VIDEO
• SESSION 4: RESILIENCE AND ENCRYPTION
• Want to try out WebRTC Insights?

Why an RTC@Scale summary?

Philipp decided it would make sense to summarize the recent RTC@Scale “recruiting event” that Facebook did – the RSVP was explicitly asking for consent to be contacted. The technical depth of the talks was amazing so we’ve added an “out of order” issue for you, just for this

The intent is for you to *not* spend 5 hours but rather to focus on the select sessions that are relevant for you.

The event setup was simple:

• All sessions were pre-recorded and simply played back at the time of the events
• The QA sessions were done live
• Everything resided inside a Facebook Live link
• The event page is (obviously) on Facebook: https://www.facebook.com/atscaleevents/videos/?ref=page_internal
• If you want to watch the full 5 hours, you can use this link

KEYNOTE, PANEL AND WRAP-UP

Real-time Communication for Today and Future Experiences / Maher Saba @ Meta

• Product-focused, make your product managers watch
• Now this is a good recruiting pitch with all the fancy things you could work on!
• One wonders if you will get interviewed on a VR whiteboard when applying…

Panel: RTC in the Metaverse / Sriram Srinivasan, Mike Arcuri, Paul Boustead, and Cullen Jennings

• Product-oriented, a lot of talking. Watch with a glass of wine
• 40 minutes felt too long
• The question everyone avoids is “what is Fortnite doing?”

SESSION 1: FUTURE RTC EXPERIENCES

These sessions focus on roadmap and far future views. We’d rather have a bit more on the here and now and the immediate future requirements than what would happen in 3, 5 or 10 years time, but hey – they are recruiting

Holographic Video Calling / Nitin Garg @ Meta

• What will the technology stack for holographic video calling look like?
• This is 5+ years into the future?
  • Encoding a single frame takes 30s currently (on i7 laptop)
  • It needs to be ~3ms to be really interesting
• Comments on BWE, delay, rate control and FEC are relevant today
  • “Typical” behavior of BWE @ 2930s looks far too unstable
• Holographic video calling is a nice topic, but niche at the moment. There are a lot more pressing aspects of scale that needs to be dealt with first

Spatial Communications at Scale in Virtual Environments / Paul Boustead @ Dolby

• Spatial audio in virtual worlds
  • Experience of rotating your head is important
  • Render loudest 3 streams is what WebRTC does by default
• P2P vs forward vs mixing
  • Server side mixing with HRTF (Head Related Transfer Function) vs multichannel spatial codec
  • The bigger the group, the more sense it would make to switch  to spatial mixing of audio (assuming you’re into spatial audio)
• Audio chain considerations
  • Watch this part for generally useful considerations

RTC3 / Justin Uberti @ Clubhouse

• Great separation into phases, make product manager(s) watch
  • Interesting that he classifies 2010-2019 as mobile-driven and 2020+ as meeting-driven. “meetings usage eclipses call usage”
• Reliability may be the expectation but who is working on that?
• There is a lot to be desired on audio, where WebRTC has (is?) been neglected
• WebRTC for music – Who remembers his 2013 Google IO session?
• Speech to text is becoming a table stakes feature
• We need a better mute button
  • But we taught people to mute when not speaking for a decade now…
• Group communication and SFUs
  • Building a good SFU is still hard, value in e2e stack. Who owns that stack? For the client side that is still Google
  • Justin mentions Agora and Twilio in PaaS and large group calls. Twilio is limited at 50 users; there are others with better group calling solutions (Look at Vonage and Daily for example)
  • The WebRTC WATCHLISTS file is a really dumb metric to gauge vendors
• Unifying RTC and HTTP/QUIC worlds
  • How the RTC congestion controller gets along with the QUIC one is unsolved
  • Also read here for more thoughts on QUIC and RTC
• Unrelated to the content itself – smart cameras with auto zoom can be super annoying
• Most of this session was focused on the history of WebRTC and the requirements of Clubhouse (audio-only). While we believe audio is important, video can’t be neglected either

Live QA

• Watch if you found the sessions worthwhile
• Justin Uberti does not wear the same clothes as in the recorded talk, breaking immersion!

SESSION 2: AUDIO ML

Audio ML is quite interesting. Large vendors are at it, and when (if?) the results will trickle into vanilla WebRTC is yet to be seen. Key takeaway: ML-based noise suppression is more important than echo cancellation these days.

Developing Machine Learning Based Speech Enhancement Models for Teams and Skype / Ross Cutler @ Microsoft

• Watch if you care about audio quality but very technical (and scientific)
• Specific “what could have been better” questions can turn the common (and somewhat useless) five star rating” into something that is actually actionable
• Audio capture pipeline enhancements for noise suppression
  • Lots of almost-scientific evaluation
  • CPU perf evaluation followed by A/B testing in the fields
• Audio capture pipeline enhancements for combined AEC/NS
  • No A/B testing results sadly
• Packet loss concealment

Can AI Disrupt Speech Compression? / Jan Skoglund @ Google

• Watch if you want to learn more about audio codecs
• Use-case is 2G/3G connections and limited data plans
• WaveNet sounds drunk with background noise or music
• Lyra and SoundStream
  • Realtime performance on a smartphone CPU
• Lots of listening comparisons
• Combine denoiser and codec
• Guess what kind of music he plays

Live QA

• Watch if you found the sessions worthwhile

SESSION 3: VIDEO

AV1 is coming. It will take time to be here. To get a grip over it and see what companies are doing, we got Google and Visionular.

Google is what goes inside WebRTC. Visionular is what you can buy commercially on the market for server or proprietary implementations.

Your focus should probably be in low bitrates and slide sharing scenarios.

AV1 Encoder for RTC / Marco Paniconi @ Google

• Watch many times if you are a video expert. Otherwise just read this summary
• RTC requirements differ from “encode a video”. Encoding screen share? We got you!
• There is a “webrtc team” they are working with?
  • Ah, the one that maintains apprtc… which is down. Yes there is a deployment guide but… can you click the link? No…. (we’re still frustrated like many at taking down appr.tc with no public explanation and so surprisingly)
  • AV1X” is gone as of M96. See PSA. Missing from the release notes of course!
• Unsurprisingly Duo and Meet are the use-cases driving this
  • Make sure to review the BW reqs on that slide
• AV1 is being tested in Meet for screen share? We will monitor!
  • AV1 has a special mode for screen sharing
• SVC is there but the WebRTC-SVC API to enable it is not making much progress

AV1 for RTC: Current and Future / Zoe Liu  @ Visionular

• Easier to follow than Marco due to being a more sales-y deck
• Watch if you are considering licensing what Visionular oes
• A bit long for a sales deck
• Lots of numbers, great if you understand those
• apprtcmobile is … well, the state of that is unclear

Live QA

• Watch if you found the sessions worthwhile
• AV1 in Duo was low-bitrates, low resolutions. Tsahi predicted this would be the roll-out pattern
• No, SVC is not there yet (as an API). Unless it is enabled by SDP munging too…?

SESSION 4: RESILIENCE AND ENCRYPTION

We found this part to be most applicable to current problems. This is where you should be spending your time and focus right now

Making Meta RTC Audio More Resilient / Andy Yang @ Meta

• Highly applicable to WebRTC today. A primer on audio resilience, watch!
• The presentation style is a very welcome change, giving a roadmap!
  • As developers explaining the impact of your work is important
• Excellent of common audio problems resulting from packet loss and jitter
• Great comparison between NACK, opus FEC and RED
  • …and how the mechanisms work in detail
  • NACK for audio is a nonstandard feature. See here
  • Note that opus in-band FEC has reduced quality and that “no additional bitrate overhead for FEC” is not a good idea while video is active.
    • Good explanation of the downside of in-band FEC for the SFU (removing FEC is possible but nontrivial)
    • The other main problem with in-band FEC is the lack of a control surface
  • Duplication adapting to bursty loss is theoretically interesting
  • SFUs adaptation of RED was brought up by Jitsi’s Boris on WebRTCHacks
  • Bandwidth adaptation of RED in libwebrtc/chrome is not solved yet
• Resiliency recap
  • This is a great slide but WebRTC support for “duplication” is wrong, it was there and is available in Chrome as of M96
  • Overprotection is a problem, RED+fec makes no sense
  • Here’s how we’d summarize these techniques:

• Make sure to read about opus FEC and RED here

• Resiliency vs delay
  • Classic E-model diagram
  • Great latency analysis of the stack with breakdown of the budget
  • A rare NetEQ and jitter buffer explanation. NetEQ remains relevant a decade after the GIPS acquisition
  • Note that there is no RTX for audio so the packet may be treated as “just” late (a plain resend). This is a major issue for video where rtx is used most of  the time to avoid this problem. Do we need RTX for audio? Maybe…
  • NACK and retransmissions will increase the jitter buffer delay otherwise?
  • WebRTC in the browser does offer a very limited control surface for this kind of experimentation… but it is clearly necessary
• Technical metrics vs actual user perception
  • Measuring technical metrics (see e.g. RED post on hacks) is easy
  • Actual perception is hard
  • A very open problem indeed!
• Summary – rewind, watch!
  • We want to know your story, tell our recruiter. Great pitch!

Private Calling at WhatsApp / Xi Deng @ Meta

• Again, giving a roadmap and mission statement is great!
• 15 billion minutes talking on whatsapp each day…
  • Remember the 2018 “3 billion monthly” for Chrome?
  • One wonders how they compare to the largest telcos in the world
• Great definition of “privacy” when it comes to calling. Metadata? Such a pun!
• Interesting threat scenario
  • “no trust to faceless corporations” (how meta can Meta be?)
  • Do not leak location (or IP) to strangers. Zoom auto accept anyone?
  • Multi-device messaging and calling is a hard problem
• Conflict for using data to improve service
  • What metrics are sensitive and which ones can you use to improve?
• Private 1:1 calls
  • Pass-through servers seem like a relic of Whatsapp starting with XMPP as a protocol back in the day
  • Multi-device diverges from modern XMPP though
  • See also later slide on challenges of client-centric multi device
• Decoupled relay server
  • The Whatsapp stack seems still different from the Messenger one and not using “standard” terminology even
  • Electing a common relay server seems wrong. ICE does not require that
  • Whatsapp seems to use a relay-first approach with opportunistic P2P4121
  • Disabling P2P for “strangers” is a very good practice

• E2EE for media content
  • SRTP RFC 3711 does not provide E2EE. “master secret” is a very specific SRTP term. This is equivalent to SDES (boo) but is protected by E2EE (using the Signal protocol) which makes it ok-ish…
  • Having to generate different master secrets for different devices seems bad compared to DTLS-SRTP
  • It is concerning that Whatsapp continues to use SDES effectively and does not consider DTLS-SRTP (with its small setup latency) to be a solution
  • Identity is already a problem for chat messages. One wonders what percentage of sessions have a verified identity
• Audio-video switch
  • A classic example of signaling glare
  • Unclear why a distributed consent algorithm is needed
  • The use-case for “oh my phone is an actual phone and can not do video” is shrinking
• Multiparty
  • In XMPP terms the “group call storage” would be a MUC room
  • Selecting the best SFU makes more sense here than for relay servers
  • Warp protocol might be a frame header in the RTP payload before the actual codec payload
  • Unclear why the “master secret” which is a SRTP term (and hence on the leg between client and SFU) needs to change when participants join or leave
• Recruiting pitch at the end too!

Group Call End-to-End Encryption and the Challenges of Encrypting Large Calls / Abo-Talib Mahfoodh @ Meta

• Highly relevant if you are looking at E2EE for WebRTC
• And another session with a mission and roadmap!
• Recap of the SFU architecture and what it means for encryption
• Where does frame encryption happen in the client pipeline
  • libwebrtc provides the FrameEncryptorInterface and FrameDecryptorInterface since 2018 but no implementations. Insertable Streams could not reuse those sync interfaces
• Key negotiation
  • Sender key vs session key approaches
  • Session key is weaker than E2EE and only protects from the SFU which is still relevant in some use-cases
  • Note that the sender key is symmetric and all receivers must know it to decrypt, but they could encrypt with it. This is not a problem since the receivers can not send media with the SSRCs of the sender so impersonation is not possible
  • Joining the call requires a ratchet operation (which is cheap)
  • Someone leaving the call requires a rekey which is O(n^2) so expensive

• Scaling group call E2EE
  • How large do you need to scale at? A meeting with 100 participants is not “private” so session keys might be more appropriate
  • Prioritizing key exchange based on whether you are planning to send becomes important
  • Rekey is expensive and larger calls have a higher participant churn making this a hard problem. A small time window to batch this operation helps
  • Failure to deliver rekey messages is odd, signaling has to be reliable or something is wrong with your overall system
• No recruiting pitch?!

Live QA

• Watch if you found the sessions worthwhile
• out-of-band FEC does not work for audio due to the latency increase. It works for video where frames are split into multiple packets
• “RS code” is Reed-Solomon FEC, https://datatracker.ietf.org/doc/html/rfc5510
• MLS is the IETF effort for standardizing group key exchange

Want to try out WebRTC Insights?

What you are seeing here isn’t the run of the mill issue of a WebRTC insights newsletter. It wasn’t even intended. But it does show the effort and focus we put on everything WebRTC for our clients. Watching a five hour event twice and producing actionable notes is not an easy task. It changed our weekend plans but we ended up being very satisfied with the results if only for our own notes.

If your company is relying heavily on WebRTC, then you should at the very least try this out. Reach out to me via the form at the end of the WebRTC Insights landing page and I’ll send you a sample issue.

The post RTC@Scale summary and insights appeared first on BlogGeek.me.

The performance of WebRTC in Chrome as well as other RTC applications needed to be improved a lot during the pandemic when more people with a more diverse set of machines and network connections started to rely on video conferencing. Markus Handell is a team lead at Google who cares a lot about performance of […]

The post Optimizing WebRTC Power Consumption (Markus Handell) appeared first on webrtcHacks.

How time flies when you’re having fun… For me the definition of fun was starting BlogGeek.me, deciding to write about WebRTC for the first time and having 10 years fly by.

I had a few updates to write with no specific theme to them. Mostly about things just completed and a few upcoming projects and events. Then it dawned on me that I’ve been at it for a bit over 10 years now (!)

On January 5, 2012 I published the first post on this blog. I just left RADVISION for Amdocs, and wanted to have a place of my own out there that won’t be controlled by any vendor. So I started BlogGeek.me. I didn’t know what I was going to write about, but I did know it will include some 3-4 posts about WebRTC before I move on to other technical issues.

That first WebRTC post? Got published on March 8, 2012. It was about what’s WebRTC. Fast forward 10 years later, and more people today know BlogGeek.me than know me as Tsahi. And in many ways, BlogGeek.me is synonymous with WebRTC articles. Not what I had in mind when I started, but I am definitely happy with where it led me.

Anyways, here are a few updates on my ongoing projects, as well as where to find me.

Free eBook: WebRTC for Business People

Earlier this month, I updated my WebRTC for Business People ebook.

Its last update took place in 2019, before the pandemic, so it really needed to get up to speed with where we are now. I worked on this update in the last couple of months, updating much of the content and replacing many of the showcased vendors.

I’d like to thank Daily for picking up the sponsorship for this work. They’re one of the fascinating CPaaS vendors out there innovating in the domain of UX/UI.

Download the WebRTC for Business People ebook for free

WebRTC Trends for 2022

I just finished my WebRTC Trends for 2022 workshop. Did it twice in parallel to accommodate different time zones and had a goodly sized audience joining live to the 6 hours in total.

During the workshop we went through many topics. I tried covering everything I think is relevant for 2022 when it comes to WebRTC, so that you can prepare properly.

• If you missed this, you can now enroll to it as a course and access the recorded content
• If you want this as a private session in your company, contact me

WebRTC Training Courses

The Advanced WebRTC Architecture course is due for another update.

The above image indicates the numbers for the course at the moment.

Around 15-20 lessons are going to be updated and recorded again – to make sure content is relevant and fresh.

One of the lessons will be dropped with 2-3 new lessons being added.

Until I finish all that work, I am announcing a 10% discount on all courses, ebooks and workshops on my webrtccourse.com website. Just use the coupon code 10YEARS.

If you enroll in the courses now, you’ll have a 1-year access to them which will include all of the upcoming updates.

WebRTC Insights

Philipp Hancke is running the WebRTC Insights with me. This is fun to do, especially with a good friend and partner. We’ve grown the offering in the last few months, adding video release notes interpretation for WebRTC, color coding for issues, etc.

This weekend we worked on getting our subscribers a detailed summary of Facebook’s RTC@Scale event – so they can focus on what they find relevant in the 5-hour event.

We’ve celebrated a year of WebRTC Insights recently – if you’d like to join our service for the coming year and be updated on everything technical (and non-technical) about WebRTC just let us know.

Enterprise Connect 2022: Here I come!

After two years at home, it is time to pack a bag for the first time and see a plane from the inside.

I will be at Enterprise Connect 2022, taking place in March in Orlando. This will also be my first opportunity to see in real life (!) the people from Spearline who acquired my company, testRTC. I’ll be going there to represent Spearline and showcase testRTC to whoever wants to listen.

If you are there – let me know – I’ll be happy to meet you as well.

Kranky Geek Virtual 2022 Spring

We’re going to have another Kranky Geek event. We plan to have it in April 2022.

At the moment, we’re working on the sponsors and speakers list. If you’re one of those – let me know (we keep a tight ship, so I can’t promise anything).

Here’s for the next 10 years

The last 10 years have been fun. I am actively thinking of what will happen with WebRTC and communications in the coming years. There are some trends that are just around the corner while others are more long term in their nature (web3 anyone?).

Here’s to seeing you in virtual and in person during 2022 and beyond

The post WebRTC, BlogGeek.me, 2022 & 10 years of blogging appeared first on BlogGeek.me.

Exploration and examples of the 5 different ways you can save an image from your webcam in JavaScript in 2022. Includes canvas.toBlob, OffscreenCanvas, createImageBitmap, ImageCapture, and ReadableStreams / MediaStreamTrackProcessor

The post Ways to save an image from your webcam in 2022 appeared first on webrtcHacks.

I have been looking at these Chrome usage statistics available on chromestatus.com for a while together with Tsahi Levent-Levi for WebRTC Insights but they are too fascinating to keep them behind our paywall. Let’s do some coffee ground reading on the usage of a number of important APIs and what it tells us about what […]

The post How is WebRTC doing and who is driving usage? (Hint: Google Meet) appeared first on webrtcHacks.

A look at WebRTC trends and what is in store in 2022, especially now, as the market is heating up and differentiation and proprietary are again.

We started this year with my WebRTC trends for 2021, so it is time to conclude the year (stating that I was generally spot on), and look at what 2022 is bringing us. In many ways, 2022 is a continuation of what we had in 2021 with some interesting nuances.

My main worry is that a war is brewing. On one hand, Google is leading WebRTC, but probably not seeing enough value out of it as a big corporation. On the other hand, much of the rest of the industry is frustrated at what is taking place with the main WebRTC library – libwebrtc – that is maintained, controlled and owned by Google. This is leading to many different forks along with discussions and attempts to find a better structural solution to this big initiative called WebRTC.

A lot of this is trickled throughout the year as part of the WebRTC Insights service that I am running along with Philipp Hancke.

I can ramble on in this overview, but it is best to just… start running with it.

Table of contents

• WebRTC’s differentiation era
• Peak WebRTC
• Google and libwebrtc
• Breakout open source WebRTC technologies
• Electron’s double-edged sword for WebRTC
• WebRTC in CPaaS is… complicated
  • Twilio
  • Agora
  • Daily
  • Vonage
  • New players
  • Widgets, Embeddables, Prebuilt
• WebRTC Trends in 2022 – more of the same?
  • #1 – Scale & performance
  • #2 – #newtech
    • WebAssembly
    • WebTransport & WebCodecs
    • AV1
  • #3 – WebRTC infrastructure, hyperscaling and SD-WAN
  • #4 – Live Streaming
  • #5 – 2D to Metaverse
• WebRTC market forces
  • Big Tech: FAAMG and WebRTC
  • Twilio’s disinterest in WebRTC
  • The Zoom elephant
  • Coopetition in WebRTC
• Upcoming WebRTC Trends 2022 workshop

WebRTC’s differentiation era

Two years ago we shifted gears, moving from the Growth era in WebRTC to the WebRTC Differentiation era. I discussed that at length earlier this year, when I explained how WebRTC differentiation manifests itself.

It started with Google splitting up their WebRTC development efforts, making decisions on what to place in libwebrtc, their open source implementation of WebRTC, and what to implement outside of it. The verdict came in a way that any machine learning algorithm that can be kept outside of WebRTC – will be.

Other large vendors understandably followed suit.

Peak WebRTC

Have we reached peak WebRTC?

Philipp made me aware of the Chrome Platform Status website and the many statistics you can find there. It makes it possible to track how many page loads include certain API calls, with many of these relating to WebRTC. The one I selected for the diagram above is that of GetUserMediaPromise, showing how often do web pages that are loaded in Chrome ask permission to access a camera or a microphone – leading more often than not to a WebRTC session.

We’ve seen a huge increase in use of WebRTC throughout the pandemic, and now things seem to be settling down for the last half year on ~x4 times what they were prior to the pandemic. Will this last or not is a good question. Clubhouse seems to have plateaued since its strong debut for example.

No one really knows what the next 12 months are going to look like, and if Omicron or yet another strain of the virus will push us back to the safety of our homes and quarantine – or what things will look like when we find ourselves on the other end of this pandemic.

Google and libwebrtc

Google has a stranglehold on WebRTC – for better and for worse.

ALL web browsers today that support WebRTC do so via libwebrtc, which is Google’s implementation of WebRTC:

• Google Chrome, obviously makes use of libwebrtc
• Microsoft Edge, essentially a skin on top of Chromium (=Chrome) which… uses libwebrtc
• Apple Safari, that takes libwebrtc and then backports it into WebKit
• Mozilla Firefox, who have libwebrtc embedded into Firefox and need to upgrade it from time to time (just did a big upgrade recently)

Google seems to have shifted to a kind of a maintenance mode with WebRTC. They have also changed their mindset and are focusing with libwebrtc on what’s good for Google. It all makes sense. For them…

After 10+ years of holding up the mantle for the whole industry, it is becoming tiresome, especially when there’s not enough to show for it internally. The shift was inevitable.

Google is doing what is good for Google with WebRTC

That means that if your use case falls within the realm of what Google does and needs, then you’re in good shape and good luck. And if you aren’t… well…

In the meantime, the industry around WebRTC has good meaning people. Those who want to see WebRTC grow, flourish and thrive. They are trying to help, but helping is HARD:

• Getting a fix/update/new feature into libwebrtc as a Google outsider isn’t simple
• libwebrtc sits in 1-2 billion devices, so Google won’t be taking contributions blindly
• There’s the liability angle of it, which Google takes up upon itself for anything that gets crammed into Chrome – and libwebrtc; they even pay for security bugs others find
• And then someone need to test it all, which takes resources, so Google needs to justify that effort
• On the contributor’s end, it isn’t just fire and forget – you can’t send a few lines of code and expect it to be integrated into libwebrtc and Chrome
• You actually need to put an effort and sweat it out – explain why this contribution is needed – why it “belongs” to you – how it will help everyone
• And let’s face it – we love writing code but not comment, explain or sell it to others
• Oh, and the companies? They want to be involved but don’t want to put the manpower and money where their mouth is

A deadlock.

Breakout open source WebRTC technologies

There has been a lot of open source built around WebRTC and in the recent two years that has accelerated as well – the pandemic and all.

What we’ve seen in these 10 years are a few distinct open source projects that have broken out from the pack, making themselves more popular than others. I know the list here is lacking and others are used as well – but assume that these are the ones I see the most in the market when it comes to open source (I am intentionally ignoring the VoIP/SIP open source projects such as FreeSwitch and Asterisk here).

The illustration above shows my current thinking about the trends surrounding these top open source WebRTC technologies:

• Kurento has been on an ongoing downward spiral. This started some 5 years ago with Twilio’s acquisition of the Kurento assets. They took all the knowledge and left Kurento practically an empty shell. Since then, the project never bounced back. So much so that the team maintaining it who later built OpenVidu started the migration from Kurento to mediasoup themselves
• Janus has been going strong over the years. Today, I see less of it in new projects though. Something has slowed down there. It might be due to the other rising projects or due to the shift in focus of the meetecho teams towards NDI, OBS and streaming – a niche in the WebRTC ecosystem
• Jitsi is great. 8×8 has taken the mantle from Atlassian and leaned in, investing further into the open source project (kudos to Emil Ivov – this isn’t an obvious decision to make). Jitsi is feature rich, but suitable for video conferencing use cases. Things outside that scope are probably a better fit to one of the other alternatives
• mediasoup is another excellent choice. In recent years, the number of users adopting it in their projects has grown considerably. Most of the feedback I hear about it is positive
• Pion is interesting. It started off as a kind of a Go lang implementation of WebRTC and now it does everything from a client side solution to an SFU, with multiple other open source projects built on top of it. For some tasks, this is the best solution out there today

Electron’s double-edged sword for WebRTC

Then there’s Electron. A PC application framework built on top of the Chromium browser engine – Electron is popular with WebRTC apps as well.

Electron is a great starting point: you write your web app. Wrap it with Electron. And you’re done.

But in many ways, that’s just the beginning of your journey. Arnaud Budkiewicz of RingCentral spoke at the recent Kranky Geek about their journey:

Using Electron means surrendering to the Chromium+libwebrtc release cadence that Electron has opted for – or digging deeper and owning that technology stack as well.

WebRTC in CPaaS is… complicated

Using CPaaS WebRTC solutions was never easy, and in 2022 it is going to be even more complicated. Why? Because the landscape is unclear.

Twilio

Twilio is chasing CEP butterflies. I am all for it – though sadly it has nothing to do with WebRTC.

They have been slow to respond to the market changes when it comes to WebRTC, and it still feels like WebRTC is an afterthought to them.

Agora

Agora’s stock has been acting out after their successful IPO.

While their performance and traffic is going strong, there are market uncertainties there – peak WebRTC is one, and the huge spike is Clubhouse (using Agora). The Chinese government regulation is another. I am singling out Agora here because they are the only CPaaS vendor focused on RTC that is a public company.

Daily

On the positive side, we’ve seen the investment in Daily – $40M in series B.

The company is growing, focused on their WebRTC implementation for developers.

Vonage

Vonage just got acquired by Ericsson. That leads us to this acquisitions chain when it comes to their WebRTC CPaaS capabilities:

TokBox → Telefonica → Vonage → Nexmo → Ericsson

• TokBox was acquired by Telefonica
• Then Vonage acquired TokBox from Telefonica
• … wrapping TokBox under the Nexmo CPaaS platform
• … which was then rebranded as Vonage API and Vonage Video API
• … and now Vonage has been acquired by Ericsson

We will see where this takes the Vonage API platform.

New players

We still have newcomers to this market. Big and small. We’ve seen Microsoft and Amazon jump into CPaaS – and especially to where WebRTC is being used in CPaaS. Zoom is dabbling with an API for CPaaS lately as well.

But also newer players such as 100ms with an interesting concept to their APIs, enabling developers to offer hints of their use case, or doing more in the background for the developers than the “classic” vendor solutions.

Widgets, Embeddables, Prebuilt

The market is also growing and maturing in CPaaS. We’re starting to see higher level abstractions, offering the UI/UX along with the APIs themselves. These come in different shapes, sizes and names, but they are all geared towards making the lives of developers easier.

Which one should you be using?

Will the one you choose be there next year?

Is he going to shift focus and bail on you?

Are the APIs and capabilities he is offering actually going to work?

Lots of questions. No easy answers.

WebRTC Trends in 2022 – more of the same?

After this long preamble, it is time to talk about the WebRTC trends in 2022.

The 5 biggest trends for WebRTC in 2022 are taking slightly different routes than we’ve seen before. Some focus on scale while others on new requirements and others still on new markets.

#1 – Scale & performance

There’s a saying/quote in Hebrew – “you start as fast as you can, and then you continue to accelerate slowly”. This is where we’re at with WebRTC.

This is obvious, and a continuation to 2021. Scale still matters. A lot. This is going to stay strong as an initiative well into 2022.

In our Kranky Geek event of November 2021, Google shared the work they’ve done in the past year. Below is the slide presented around performance optimizations. As you can see, this is an ongoing effort with multiple tasks. A lot of this has been achieved, but more is being done.

These improvements are aiming towards better scalability of a single session for multiple participants. The many bugs we now track in the recent couple of months around hardware encoding and decoding as part of the WebRTC Insights shows that this will continue well into 2022.

At the same time, we are seeing investments being made by many on the infrastructure level to scale their services.

What was the case in 2021 will be in 2022 as well.

#2 – #newtech

There are a swath of new technologies that are just now starting to mature. They are enabling vendors to do more with WebRTC. At Kranky Geek, for example, we’ve spent considerable time with these technologies and seeing how various vendors are making initial use of them.

WebAssembly

Probably the crown jewel of enablers in the web today.

WebAssembly speeds up performance of web code AND enables cross language compilation. For WebRTC, the main benefit here is the use of WebAssembly for machine learning tasks used for media manipulation. From noise suppression, through background replacement and funny hats, to video lighting. All these are enabled with WebAssembly today.

Expect more vendors to use this and expect more features to be enabled by this.

WebTransport & WebCodecs

Not happy with WebRTC? There’s WebTransport & WebCodecs.

Together, they theoretically enable you to encode and decode media and send or receive it from a server.

The devil here is in the details, and while not favorable yet to replacing WebRTC, they do look promising. We’ve had Dolby and Intel share some of their insights on these at Kranky Geek.

What we are going to see is more vendors experimenting with these technologies as well as using them alongside and with WebRTC where it makes sense. I’ve pointed to this approach over a year ago, as part of the WebRTC unbundling process taking place.

With Google’s own enthusiasm about these, one wonders if they will lose interest in WebRTC a few years down the road.

AV1

Then there are new codecs.

AV1 has been around since 2018. Not exactly… obviously… some people have been pushing it as a solution for WebRTC since 2018. The truth of it is that at the end of 2021, AV1 is yet to be seen anywhere significant when it comes to WebRTC. Not because it isn’t good, but because it takes time to release a new codec to market – especially a video one.

Well, the wait is somewhat over. AV1 is coming to WebRTC and we will see use of it in 2022. It will still be limited, but it will finally be interesting and relevant.

A new ML-based voice codec (think Lyra) will take a wee bit longer. There’s no consensus yet as to which voice codec it should be. AV1 didn’t have that problem – we already knew AV1 would be next in line.

#3 – WebRTC infrastructure, hyperscaling and SD-WAN

How you design and deploy WebRTC is changing. The usual mesh/mix/route alternatives are still there. Many go for hybrid approaches. Focus and discussions lately went to the hardware itself, and where it is located, and how packets are routed exactly.

Agora were probably the first to do this openly and at scale, marketing it as a better approach. In 2021 we’ve seen the likes of Subspace and Cloudflare announce managed TURN services with regional distributions of 100 or more data centers.

I’ve marked infrastructure as one of the challenges in my workshop in 2021. In 2022 this is going to become an even more interesting topic. Anycast is going to join the frey as a technology used by vendors.

What we still won’t have as a definitive answer in 2022 is which one is preferable? Is there a real value differentiator and observable improvement in quality when using more than 10 regions globally. Would it be worth the effort, especially with the large cloud vendors popping out new data centers every month or so?

#4 – Live Streaming

Moving away from features and technologies to use cases.

Live streaming is here and WebRTC is how you do it.

There are other technologies, but none that works as fast as WebRTC and works in browsers.

People are getting more and more comfortable with video. Due to the pandemic, a lot of new ways of communicating at scale are here, done remotely. And people want to interact. Live. and in real time.

2 seconds latency might be nice, but sub-second is nicer.

What we will be seeing is more vendors turning towards WebRTC for that sub-second experience. There’s room for higher latencies – for many use cases. But when it comes to instantaneous, expect to see a lot more WebRTC. At least until WebTransport & WebCodecs mature enough

#5 – 2D to Metaverse

Zoom fatigue? Boring gallery view and tiles?

Everyone is trying to rethink the communications of the future, and they don’t look like the talking heads we’ve grown up on in the last 20+ years.

The two extremes I am seeing?

• Placing video calls inside 2D and 3D synthetic environments where the user’s “avatar” can roam free
• Talking about full metaverses with Facebook and Microsoft leading the way (at least for now)

We will see more of this in 2022. At the moment, there are so many different experiences being published that the most interesting thing to see will be which ones will stick and which will fade away.

WebRTC market forces

As we head into 2022, it is also important to understand who are the main players and the main market forces. These are going to shape WebRTC moving forward.

Big Tech: FAAMG and WebRTC

The biggest tech vendors are the ones setting the pace and calling the shots with WebRTC. Each with his own angle to it.

• Google – well… Google. They are the biggest user of WebRTC in the browser, they own libwebrtc, Chrome, Google Meet, Stadia and many other tools that make use of WebRTC. Mostly, what Google wants with WebRTC happens
• Microsoft – Microsoft has Skype, Azure Communication Services and Teams. All using WebRTC, at least on the web browser. They are also pushing their own initiatives around WebRTC itself, though these are mostly limited to optimizing certain areas for the Windows operating system and their Office offering
• Apple – Apple seems to be behind when it comes to WebRTC. It feels like they are pulled into it without really wanting to. FaceTime Web is probably the most public thing they’ve done with WebRTC. Apple consumes libwebrtc and contributes nothing back. That said, practically everyone is held hostage by Safari’s poor implementation of WebRTC – and only Apple can improve that
• Amazon – Quietly and diligently, Amazon has its own growing number of services and products that make use of WebRTC. It includes Kinesis, Chime SDK, Amazon Connect, Alexa and others. They don’t seem to care much about the specification itself or a specific browser implementation of it and are happy with what they get
• Facebook – owner of Messenger, Instagram and Whatsapp is probably one of the biggest vendors when it comes to WebRTC traffic

You can add to this list Intel, who are now pushing the envelope on hardware encoding for WebRTC, something that was usually ignored by hardware vendors.

In 2022, these will be the shapers of WebRTC as we know it. They will decide if they listen to external feedback and pour it into their own product roadmaps or not – and that will end up affecting us all in the WebRTC ecosystem.

Twilio’s disinterest in WebRTC

As I stated earlier, Twilio doesn’t really care about WebRTC. Not much anyway. WebRTC isn’t big money for Twilio, so they are focusing elsewhere. We do make use of Twilio’s video-js repo as a good source of bug reports (Twilio and Vonage are still ahead of most everyone else in that).

As the dominant CPaaS vendor that is a proxy for other vendors:

• They can either doubledown on WebRTC and video
• Or they can try to compete with Twilio head to head, shifting their focus away from WebRTC as well

This isn’t the best of environments for those who want to use CPaaS, and to some extent, this isn’t productive for those who want CPaaS either.

It also dilutes the power that CPaaS vendors have (or want to have?) over the direction WebRTC is headed. It would have been great to have these vendors’ voices heard more, as they aggregate behind them thousands of companies, use cases and requirements. Part of it is why I think UCaaS is outpacing CPaaS in innovation.

The Zoom elephant Is Zoom the exception to prove the rule?

Zoom doesn’t really use WebRTC, but it does affect everything there is around WebRTC:

• Vendors using WebRTC oftentimes end up competing with Zoom in the market
  • This is true for many verticals and market niches
  • Zoom has the advantage of being widely known and used already, due to its status as the pandemic’s poster child
• Capabilities in WebRTC are compared to Zoom’s capabilities
  • Gallery view and the magical number 49
  • Introducing REDundancy encoding in Opus
  • CPU use, etc
• Zoom is betting on WebCodecs+WebTransport+WebAssembly as a WebRTC replacement and a way to differentiate it from the crowds
  • Would others be taking this same route?
  • Would Google at some point take it as well, and lose interest in WebRTC?
  • Time will tell

Without being a part of the WebRTC ecosystem, Zoom is a big shaper of the WebRTC market.

Coopetition in WebRTC

Coopetition exists everywhere. The notion of competitors cooperating together is something we see a lot, especially in standardization organizations, where vendors are chugging it down, trying to get to an agreeable, better place for everyone (=lowest common denominator). We’ve seen it with the decision on mandatory to implement video codecs in WebRTC for example.

What we’re now seeing more is collaboration between companies directly – ones that compete in some ways and cooperate in others.

Microsoft improving screen sharing in Google’s libwebrtc (after deciding to adopt Chromium for Edge), Intel helping with hardware encoding of AV1, RingCentral and 8×8 pushing to get RED for Opus into libwebrtc, …, the list goes on.

We’ve come to a point where it is acknowledged that we can’t just sit and wait for things to “happen” on their own with WebRTC on the implementation side and there needs to be more proactivity and cooperation. Vendors need to start investing more and publicly in the baseline open source implementation and not only in their proprietary code.

This is wishful thinking most of the time, but I think we’re at an inflection point where this will need to happen more for the WebRTC community and ecosystem to take the next step in its evolution.

Upcoming WebRTC Trends 2022 workshop

In January I’ll be conducting a workshop that covers these topics. The trends and what to do with them. It will offer actionable advice on what you should do in 2022 and it will be interactive in nature.

My WebRTC trends in 2021 workshop was well attended. Here is what Stefan Karapetkov of Twilio had to say about it:

I was looking for an update on the WebRTC market and technology trends, and the workshop provided exactly that.

The information was specific, very well organized, and delivered in an engaging and entertaining way.

The workshop was split into three sessions and gave me enough time to think about the material, do additional research, and prepare questions for the next session.

I left the workshop with a solid understanding of the WebRTC technology, even more importantly, of the many technology tradeoffs that the WebRTC community made along the way.

I use this knowledge in my everyday interactions with colleagues and customers, and think that the workshop would beneficial for anyone in a Video Product Management or Architecture role, even for Solution Engineers who specialize in Video.

The 2022 workshop is going to be just as structured and useful, with ample interactivity that will give you the opportunity to interrupt and ask questions relevant to you and your business.

This new workshop, WebRTC trends for 2022, will take place during January-February, in 3 consecutive sessions of 2 hours each.

Space is limited, so if you are interested, register sooner rather than later.

See you at the workshop.

Register to WebRTC trends for 2022 workshop

The post WebRTC Trends for 2022: Proprietary & differentiation are back appeared first on BlogGeek.me.

Spearline acquired testRTC and now supports WebRTC testing and monitoring. This will change what I do, but in good ways.

This week the announcement became public. The company I co-founded with a few friends, testRTC, got acquired by Spearline. It is the end of a chapter and an opening of the next one.

For starters – I am still going to do what I did so far – have fun and help companies with their WebRTC and CPaaS challenges.

I tried to keep testRTC at an arm’s length from BlogGeek.me and what I do here just because… well… not sure why. Probably to stay as impartial as I can with the things that I do. That said, it is probably a good time to explain where we are with testRTC and our support for WebRTC applications.

Where are we with testRTC?

We’ve started testRTC with the intent of providing a self service, cloud hosted testing solution for those developing with WebRTC. Along the way, we’ve expanded our product lines to include 3 separate domains with 5 different products:

1. Testing
   • testingRTC – our marquee testing product that can be used today for regression, stress and performance testing
2. Monitoring
   • watchRTC – a passive monitoring service that integrates with the WebRTC client application collecting data from real users, gauging quality of service that they get, both in aggregate and on the individual user level
   • upRTC – an active monitoring service, validating your application’s uptime and quality, able to understand your SLA
3. Support
   • qualityRTC – the WFH (Work From Home) support tool focusing on connectivity and quality issues by offering end users a self service route and reducing average handling time for support teams
   • probeRTC – continuous network monitoring service for office locations to deal with network fluctuations from specific locations to your WebRTC cloud service

Simply put, we are the only vendor today offering support for the full lifecycle of your WebRTC application – from development to deployment and long term maintenance of the service. We do that at scale, in the cloud, with a big smile

And then we met Spearline, and found a common ground.

Who and what is Spearline?

Spearline offers testing and monitoring for your telephony services.

They have a large global deployment with real phone numbers across 70+ countries and carriers worldwide – landline and mobile. If you need your phone numbers tested and validated for their quality and performance (and you do), then you go to Spearline. Why? Because without actually testing a number, your only insight that a number isn’t working (say your sales line) is to get a customer to complain about it – which is way too late.

This all made perfect sense for us at testRTC. When we were approached, it was easy to figure out that this falls into this category:

SYNERGY

• Same domain
• Similar customer base
• Different technologies

We’re completing Spearline in a few ways (WebRTC being an important part of it), and Spearline completing testRTC in other ways (telephony, scale and enterprise sales to give a few of the things we were after).

Which leads me to rocket surgery.

Rocket surgery

I had a technical call the other day. Related to BlogGeek.me. Someone at the call said “rocket surgery” at some point. It took me a few seconds to deconstruct that and understand it – he probably meant to say rocket science or brain surgery – just to indicate that they’re doing things that are hard, but not that hard (he said “this isn’t rocket surgery”).

Then it dawned on me. Rocket surgery is the best term I have for what we’re currently doing.

We’re marrying the best of both worlds here at testRTC & Spearline, so we can now offer our customers rocket surgery solutions. Things that no other vendor out there can do for you.

And that excites me – the things we can achieve and the plans we’re making for the future as part of this acquisition.

What changes for BlogGeek.me?

Nothing and everything.

(can you spot the 10 differences between the images above?)

I am continuing my work at testRTC as before. Not as CEO (never liked that role), but as head of products for testRTC (which is kinda like a small CEO). testRTC is my baby. I want to see it grow and flourish.

But then again, I like the diversity and the thrill and fun of doing everything. And Spearline were kind enough to allow me to continue with my extra curricular activities. These include the courses, the weekly, insights, consulting and Kranky Geek.

I’ve been thinking a lot lately about my future. And what else I want to do. I don’t have the answers to it yet. For the foreseeable future though, this is going to be helping you with your WebRTC and CPaaS needs.

Onward and upward

2021 has been a rollercoaster. I enjoyed the ride.

Here’s for a 2022 that is thrilling, exhilarating and fun.

The post Spearline acquiring testRTC – this is rocket surgery appeared first on BlogGeek.me.

There is a cool new feature everyone has been trying to implement – background transparency. Virtual backgrounds have been around for a while. Rather than inserting a new background behind user(s), transparency removes the background altogether, allowing the app to place users over a screen share or together in a shared environment. There doesn’t seem […]

The post How to add virtual background transparency in WebRTC appeared first on webrtcHacks.