Annoyances with Flash Player 9.0.124.0
28 April, 2008 - 17:50 — tomsunIn the most recent version of Flash released in mid April, Adobe has changed the rules on how .SWF files are allowed to talk back to the server. The main motivation appears to be the old model did not give the host enough control over the abilities an .SWF aplication. The new model allows for tighter security and the improved security is there by default.
Side-effects being that if you used to rely on:
- doing HTTP requests (with loadVars for example).
- having .SWF-files load other .SWF-files.
- loading data using for example XML-files or AMF-PHP or SWX.
- socket based communication
...you might be in trouble now as the masses slowly update their Flash Players. Unless you are up to speed with the new policy conventions that is.
Go through this document (split into 7 pages) to get the full details:
http://www.adobe.com/devnet/flashplayer/articles/fplayer9_security.html
To find out which version of the flash plugin you have installed, visit:
http://www.macromedia.com/software/flash/about/
To summarize, there are two classes of SWF it is allowed to do:
1. Url Policies (crossdomain.xml)
2. Socket Policies (port 843)
Url Policies (/crossdomain.xml)
An XML file, typically placed in your server's root folder. It should contain two things: The Cross-Domain Policy which tells your .SWF what it can do, and the new Meta Policy (the <site-control> tag) which tells your .SWF which Cross Domain Policies are allowed...
Starting in 9.0.124.0 the Meta Policy is mandatory, and if you don't have it your Cross Domain Policies will be ignored.
Example:
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only"/>
<!-- Top level domain name -->
<allow-access-from domain="yourdomain.com" secure="false"/>
<allow-access-from domain="yourdomain.com" to-ports="80,443" />
<allow-http-request-headers-from domain="yourdomain.com" headers="*" />
</cross-domain-policy>
You can add multiple domains, and you can also add stars to cover a range of subdomains. domain="*" is valid as well if you want to give the .SWF full access
Example 2:
<cross-domain-policy>
<site-control permitted-cross-domain-policies="master-only"/>
<!-- Top level domain -->
<allow-access-from domain="yourdomain.com" secure="false"/>
<allow-access-from domain="yourdomain.com" to-ports="80,443" />
<allow-http-request-headers-from domain="yourdomain.com" headers="*" />
<!-- Subdomains -->
<allow-access-from domain="*.yourdomain.com" secure="false"/>
<allow-access-from domain="*.yourdomain.com" to-ports="80,443" />
<allow-http-request-headers-from domain="*.yourdomain.com" headers="*" />
</cross-domain-policy>
If your .SWF loads data from a remote server, the remote server might need to have a permissive /crossdomain.xml as well (http://kb.adobe.com/selfservice/viewContent.do?externalId=kb403185&slice...).
Socket Policies (port 843)
If your application communicates using sockets, the crossdomain.xml does not cut it.
In my case I was using the Actionscript 2.0 version of the XIFF library which lets you build chat rooms using on the XMPP instant messaging protocol with an XMPP server like Openfire as backend.
In a situation like this, Adobe wants you to serve a similar XML structure as crossdomain.xml, but on port 843 with a specialized service (see below). This is the so called Socket master policy file.
Example:
<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "/xml/dtds/cross-domain-policy.dtd">
<!-- Policy file for xmlsocket://socks.example.com -->
<cross-domain-policy>
<!-- This is a master socket policy file -->
<!-- No other socket policies on the host will be permitted -->
<site-control permitted-cross-domain-policies="master-only"/>
<!-- Instead of setting to-ports="*", you can use ranges and commas -->
<!-- This will allow access to ports 123, 456, 457 and 458 -->
<!-- allow-access-from domain="yourdomain.com" to-ports="123,456-458" / -->
<allow-access-from domain="yourdomain.com" to-ports="*" />
</cross-domain-policy>
This information needs to be served by a socket policy file server on port 843 though. Adobe provides a reference implementation in Python and Perl. I successfully got XIFF working using this method.
5 minutes with Kyte Mobile
8 April, 2008 - 22:46 — tomsun
I just did some more research into what other players in the mobile video niche are up to.
Still waiting for a chance to try out Qik thorougly but they don't seem to like me at all (get no sms when I try to sign up... also tried with the special deal for Mogulus users, without result).
What I looked at instead tonight was Kyte's mobile application. Pouria was eager to get my eyes on it so I looked up my old Kyte account and downloaded the S60 installer. I even grabbed my camera to get a few snaps of the experience. The approach I had was basically to jump into it quickly and give Kyte Mobile just a few minutes, with the mission to find out if there are similarities with Bambuser and maybe also identify a few things we can learn from them.
On the first run the Kyte app displays a splash screen followed by a note to accept the End User Agreement. Then you end up at the login page asking for your username and password. Supposedly you can click "join now" and enter some details about yourself to get going right away if you haven't signed up through the website (didn't try as I had an account). The App keeps you logged in, so you don't have to see the user agreement and login form on consecutive launches.
Next up is the main view, containing "Watch channels", "Produce a Show", "My Kytefeed" and "More" (help, about, sign out and other less important stuff). Really neat so far! The approach with broadcasting and watching in the same package gives me a nice cousy feeling, whereas on Bambuser we, for technical reasons, have these features split it up into a S60 broadcasting app (Movino) and a mobile website with a Flash Lite 3 player as well as a standalone Flash Lite 3 alternative that doesn't rely on the phones built in browser. The Bambuser approach is not necessarily a bad thing - It gives us slightly less ease-of-use-points but it's certainly good from a development standpoint when moving forward, not to have to deal with it all in the Symbian C++ environment.
I start by taking a closer look at what others are doing on Kyte.
It turns out, most of the videos in the live section has a lock icon next to them. I scroll down until I find a video signalling it's open for access, and click it. What shows up is a still image and some not so nice language in a lower 3:rd chat interface.
Then I realize most of the videos are not videos. There are still images and slideshows as well. Most of them are several days old, which makes me think "live channels" means "someone is chatting in this channel right now". When selecting the featured section I actually find playable videos, which seem to be edited, as there are cross cuts between different scenes. Playback is at roughly 50% screen size. I also realize the lock doesn't block access to a video. Not really sure what it does - blocking access to the chat maybe?
I quickly get tired of the watch section, but the excitment for what's waiting on "Produce show" is still there. This section contains "QickPix" (still image? did not try..), "QuickVid" (30 sec videoclips, uploads afterwards), "QuickAudio" (did not try), "LifeStream" and "Show Wizard".
The first thing I try is "LifeStream" which I happen to read out as "Live stream" in my head the first few times. Initially I believe this is the Bambuser or Qik alternative. Until I hear the fake shutter sound my N95 makes when taking photos. No, "LifeStream" is about taking snapshots every 30 seconds. You can adjust the interval but I did not get it to snap quicker than the default (I think...). No audio.
As I'm trying this, I appear on the kyte.tv frontpage in a section labelled "Channels with a live audience". And the way my audience is live is in text form in the chat room my channel page turns out to have. When chatting to myself at this single occation, the delay until messages are displayed on the phone seems to be around 2 seconds. As when in watch mode, the messages appear on the lower part of the screen. This kind of confirms Live means there's an active chat room in this channel right now. I think...
When played back later, the images are shown as a slideshow with 1 sec interval. I'm not sure how to link directly to a "show" (as all of these variations of uploading content are called), but visit http://www.kyte.tv/ch/19076-tomsun and hover over the player, then click "previous show" and scroll to my first show to see my slideshow example.
Before my 5 minutes are up I try the QuickVid as well, which as mentioned is fixed to 30 seconds and not broadcasted live but uploaded after the fact.
You begin by clicking "Record" and the bar at the bottom shows time left. When you are done recording the clip can be played back on the device. Then uploading takes place when you click "Broadcast". You also have the option to discard the clip. My first try with "QuickVid" is the second "show" at http://www.kyte.tv/ch/19076-tomsun
With a tiny bit of curiosity left, I have a look at the "Show Wizard", which is displaying a list of different kinds of media, but with no content (just as the "My Kytefeed" item in the main view). I suspect, once my recorded stuff is propagated through the system, this is for making slideshows and other arrangement with my media.
What did I learn? Kyte's user interface has a nice base aproach but but get's a little bit cluttered when you get deeper into the menu tree (the "Watch" part at least). But I guess the UI and the whole concept makes more sense once you invest more time in it (maybe find an introduction video or two to watch) so it might not even be worth complaining about.
Is Kyte live mobile video broadcasting? I'm not even sure they are claiming to be. But I get the impression people sometimes think they are. The Kyte team probably have lots of stuff in the pipeline (as we all have). But in it's current form, Kyte is not in the same "real-time mobile broadcasting" niche as Bambuser and Qik. In my opinion anyway.
Update: Kyte's provides live video capabilities as a separate application in private beta, according to the Kyte blog. At the time of writing they expected a public release in march, which doesn't seem to have happend yet.
Bambuse me
16 March, 2008 - 22:26 — tomsunAttention in print
25 February, 2008 - 16:04 — tomsun
Bambuser has got some attention in Swedish print media lately.
Last Friday Veckans Affärer / Ekonominyheterna.se mentioned us together with other Swedish internet-based companies like Spotify, JayCut and Polar Rose using adjectives like "hottest", "coolest" and "most innovative".
Today Expressen.se writes about Facebook-death and "new" trends like microblogging (Jaiku, Twitter etc) and vlogging, where Bambuser is mentioned as "revolutionary service combining the two". Neat!
25 must-haves for your Nokia
20 January, 2008 - 05:13 — tomsunThe N95 blog lists must-have applications if you own an S60 phone.
Be sure to check out no 7 ;-)
Top 3 if you ask me? Movino is a given in my phones of course.
The runner-ups are Jaiku and Fring.
