Foliovision › Forums › FV Player › How to … › S3 Protected Content vs s3Flowshield
-
I am NOT running a members only site at this time. Users do not have to register for the site. I want a public access site that has ad supported video content. Video will be served from s3 (not hosted by google, vimeo)
My main concern is people making links to content I have to pay to serve and hotlinking to my video content (from their site). Meaning, I pay to serve my content to their webpage, or them embediding it into their facebook page. Not desirable. Likewise I made the content, so I want them on my site.
S3flowshield seems to solve this problem by making links that expires, so that even a person hotlinks, the link will expire shortly thereafter.
I am developing locally and not on S3 now. I’m not sure if FV flowplayers implementation of “protected content” will work in this situation. Will it or will I need both fvplayer and s3flowshield?
-
-
Hello cruiserparts,
FV Flowplayer allows you to do exactly that, no need to any other plugin. Here’s our guide: https://foliovision.com/player/secure-amazon-s3-guide
Thanks,
MartinHi,
I am reading over this to understand it before I dive in. It’s a bit long. Anyway, with respect to S3, can I set the video to be viewable, but not “downloadable?” I want user to be able to stream it not download it. Like netflix.Step 11 says this
“You need to open the Permissions section and make sure “Everyone” is allowed to download and view the file. If it’s not so, you can add “Everyone” by clicking”Add more permissions”, then selecting “Everyone” from the drop down menu and checking “Open/Download” and “View Permissions”. Don’t forget to click “Save”.”Hello cruiserparts,
both downloading and viewing needs to be enabled.
If you want to take one step further, you can only distribute your videos using RTMP which is not so easy to download: https://foliovision.com/player/serving-private-cloudfront
You can even use singed URLs with that, if you get our pro extension.
However RTMP won’t play on mobile, so you also need a HLS stream. Amazon AWS can get you that far, although we don’t have a step by step guide for that yet.
Thanks,
MartinHello cruiserparts,
the HLS guide was posted here: https://foliovision.com/player/hls-stream
Our test stream is here: https://foliovision.com/player/demos/hls-stream
Hello Tetracys,
our RTMP guide is here, it covers RTMP with signed URLs: https://foliovision.com/player/serving-private-cloudfront
Thanks,
MartinThank you very much for the quick response. From your earlier posts we came to an understanding RTMP cannot be played on mobile devices.
“However RTMP won’t play on mobile, so you also need a HLS stream.”We were specifically looking for playing Secured RTMP streams on mobile devices. I hope your HLS guide helps overcome this limitation.
I have been using S3FlowShield with success to protect my S3 videos with expirying links. However, because that plugin uses a Flash-based version of FlowPlayer I’m needing to switch to an HTML5 version of FlowPlayer so that I can program the video playback in ways that are only possible with an HTML5 version. This switch to an HTML5 player is requiring that I use the S3FlowShield plugin in a way that is causing it to no longer work (although their support desk is looking into the problem).
In the mean time I have been experimenting with expirying links using FolioVision’s version of FlowPlayer. But, unfortunately, for some reason the links are not expiring. For example, here’s a link to my S3 area, which appears to contain an expiring link, which should expire after 1 minute. However, it still accesses the video after the 1 minute expires ‘https://cvt-genesisword-com.s3.amazonaws.com/test1/Introduction-to-the-ExcelwithMacrosandVBAworkshops.mp4?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJVQ3Y5JFFB7YAR3A%2F20150702%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20150702T190201Z&X-Amz-Expires=900&X-Amz-SignedHeaders=host&X-Amz-Signature=9495c7c36ec571f1090a2a240f9bacc7544f768c9980d2db36422faf5807f325’ — I’ll keep this video active until I’ve received a reply to this post.
I’ve followed the documentation provided, but I’m stuck. Can you help me with any ideas on what I may need to do to make expiring links work?
BTW, it would be nice to have the expiry time set in seconds as S3FlowShield does.
Alec,
I’m sorta confused on what I need to do to control the expiry of video links. I have a video that runs for 11 minutes and I tested to see when a FV generated Expiring Link would no longer play the video — I found that the source code page link was active for 17 minutes after I started playing the video. And yet I had set the FV Plugin Setting to Expire in 1 Minute and to Force the Default Expiry — See screen shot at http://screencast.com/t/yrQLjdwcQAnd when you say that the default Expiry length is found in Amazon S3 I’ve generated an Expiring Link using my S3 Browser, but when I tried using it with the FV Plugin Shortcode I got the message “Video Not Found” — see screen shot at http://screencast.com/t/T648HDb6D
Hello Dennis,
the issue is that we set any expiration time lower than 15 minutes to 15 minutes, just to avoid any playback issues. I see that we don’t mention this in our settings screen, sorry about that.
1 minute expiration time should be enough if your video is set to autoplay, however mobile devices will never autoplay, so unfortunately we can’t recommend doing that.
Could you please provide any insight why you need a 1 minute expiration time?
Thanks,
MartinWith regards to expiry playback timeframe does the expiry time counter start when the page is loaded, or does it start when the video is played?
Also, shouldn’t the minimum time needed to ensure the full playback of a video be the time needed for the video player to capture the moov-atom meta data? And so if a video is rendered for Fast Start with the meta data at the beginning, then shouldn’t an expiry time set to 1 minute or less be sufficient to load a video for full playback regardless of the length of the video?
Hello Dennis,
the expiration time is counted from the moment when the signed URL was generated. That means on pageload, or even before, if you use a WP cache.
You are probably right about the meta data, once the video starts to play, it can expire. But if you seek into yet unbuffered position, it would throw an error if it’s expired.
Thanks,
MartinMartin,
I’m willing to live with the potential problem of someone seeking into an unbuffered area, because I do not anticipate it happening very much, if at all. And if they do that, the solution is to simply refresh the page and start the buffering over again.And because my videos are rendered as Fast Start (with the meta data at the front), I would really like to see the plugin enforce the 1 minute expiry that it says is possible … as shown in the plugin settings at http://screencast.com/t/PZA28xd9qLv4
So, can something be done to implement an Expiry based on these settings?
DennisHello Dennis,
the problem is that if somebody wants to pirate your video, they will find a way. Even if the download is blocked with some basic DRM, they can screencapture it.
So if you go too low with the expiration time you only inconvenience the honest user who may stop and start your longer video several times before finishing it.
Our goal is to provide a plugin which won’t allow users to break their website. If you are interested in a better protection, you might want to check our CloudFront integration which won’t give away the video URL in HTML: https://foliovision.com/player/demos/cloudfront-download-protection
Thanks,
MartinI saw this regarding flowplayer 6
” Please note that HLS only plays on iPad, iPhone (iOS devices) and OS X with Safari. Android plays as well, but it has some glitches. With Flowplayer 6 core HLS playback is possible with Flash as well.”
Now I am getting confused as to what I need to use. Martin said the following above, “If you are interested in a better protection, you might want to check our CloudFront integration which won’t give away the video URL in HTML: https://foliovision.com/player/demos/cloudfront-download-protection”
So what do I need to do if I want either of the following. I’m trying to decide and I may choose either one depending.
1) A public website (non-membership) that has VAST advertising with URLS that expire (to avoid hotlinking) and difficult to download videos. Cross platform. Honestly many advertising services require millions of page views per month which I don’t have, so I may not be able to do VAST adversising.
2) A a membership website, that does not have VASt advertising, with URLS that expire (but I may not need URLS that expire b/c the person would have to be logged in and paid), which would make sharing URLs, like on facebook possible. Difficult to download videos. Cross platform. If I use this I would use some sort of membership plugin like paid membership pro.
I’m trying to figure if paying for the videos through advertising or membership dues (or a mixture) is better (more profitable). And what the technology requirements are for both of them. AT this point I am leaning toward #2 above even if I have a free membership and no VAST ads.
3) Now that I look at Vimeo Pro, is it possible to use that to run VAST ads? I would want to block embeding in OTHERS peoples websites (and facebook), as to get the traffic to my site? Honestly, Vimeo pro looks really attractive as far as ease and price. If I can monetize with VAST and/or protect the content so that I can run a membership site, I may just go with it. What am I missing with Vimeo Pro account? It almost seems like it is too good to be true.
Hi CruiserParts,
Unless you have millions of page views, forget about advertising and focus on membership. You can always run your own ads in FV Player Pro (for other products and services) with affiliate links.
Vimeo Pro with FV Player Pro is as good as it sounds: $200/year for almost unlimited hosting with reasonable security. Vimeo Pro is amazing. With FV Player Pro, your users won’t even know you are using Vimeo or an external service.
I hope that helps.
Making the web work for you, Alec
Hi guys, following the “serving private videos with amazon s3” (https://foliovision.com/player/secure-amazon-s3-guide), I think that is not correct all information about, because the 23 section says:
If you are interested in the file protection, make sure only your account is present in list of permissions and it has all the access. Obtaining the access keys required for playback of private files s described in the Obtaining the Amazon AWS access credentials section of this document.
Amazon S3 does not allow users in ACLs, and the user of the example was “MySite” and the user of the image was “foliovision”, so I think that this is the root account but no the true “MySite” user.
So, how can I do that?
I have tried to update bucket policy to read only for a created user for the bucket and children, and update access policy to read only for the user too, I have added the keys for the user to fvplayer also. But when I try to access to a video the 403 code is returned.
ThanksHi Balduro,
Thanks for letting us know about your issue. Setting up Amazon S3 or Cloudfront is not easy. We’d be happy to do it for you: https://foliovision.com/player/pro-setup
In this case, we’ll go into your Amazon account and your website and make sure it’s all working correctly. If you think we should make a change to the documentation, please let us know and we’ll be happy to make that change.
Thanks!
Alec
Hi Alec, thanks for reply.
Actually I’m evaluating several tools for embedding media with S3 and I think that FV could be a good choice.
At the future, my web site will offers the media via cloudfront, but today explore alternatives, so I’m confused about to pay 70€ for support to evaluating FV.I feel that the proccess could be easiest.
1.- configure IAM user with read only permissions on bucket
2.-put the keys inside of fv_flowplayer
3.-show the video with expiration time.But when I do that, this does not occurs, a 403 forbidden is returned. Of course, if I make public to everyone the video FV works fine, but if I need do that, don’t need FV, do you?
Another issue is that the url is not signed in the code, and not expiration time is added. I’m using 6.0.38 version.Regards.
Hello Balduro,
you are right that our “foliovision” and “MySite” users are not entirely the same, but the point is the “MySite” user how which you generate the access keys has the ReadOnly permissions for Amazon S3.
It’s weird that your URLs are not signed in the code. Could you please post some [fvplayer] shortcode which you use (you can shorten the URL) and what you entered into “Amazon S3 Protected Content” -> “Amazon Bucket” field?
Thanks,
Martin