Down on my knees, begging you please: Stop mangling rtsp requests.
Posted: Thu Jan 16, 2025 9:53 am
From a user perspective rtsp addresses are being parsed, mangled, and re-written on the fly within ZM.
Don't do this.
Ultimately this offers a grave opportunity for finger-pointing.
The user says, "I tried typing in the rtsp address just like it said in the
docs but ZONEMINDER WOULDN'T LET ME!"
For example if you try to type rtsp://username:password@ip.addr:554/stream1.....
You hit return and POOF. The dog rips up your homework.
ZM returns:
"rtsp://192.168.0.223:554/stream1"
username: username
password:password
And the implication is "Trust us. We'll put it all back together properly for you and everything will be fine."
And it doesn't work. For any of a million reasons.
But the finger points first at ZM for screwing around with our source address. You broke it, that's very clear: but can you put it back together again? What happened to my special characters?"
But as well as the public relations disaster, there is a good technical reason why you should not do this. It's simply another good opportunity for something to go wrong. Maybe a special character does get lost. Maybe it's older equipment that does not follow the rules.
If you want to pluck out my password and username fine, but please don't rewrite my requests: I fought hard to find them and they worked fine before YOU GUYS came along and started screwing around with them.
That's just CREEPY!
That's the perception, anyway.
If security is a concern, maybe use your powers of parsing to ****** the password upon presentation to the user, or treat the whole URL as a secret.
Don't do this.
Ultimately this offers a grave opportunity for finger-pointing.
The user says, "I tried typing in the rtsp address just like it said in the
docs but ZONEMINDER WOULDN'T LET ME!"
For example if you try to type rtsp://username:password@ip.addr:554/stream1.....
You hit return and POOF. The dog rips up your homework.
ZM returns:
"rtsp://192.168.0.223:554/stream1"
username: username
password:password
And the implication is "Trust us. We'll put it all back together properly for you and everything will be fine."
And it doesn't work. For any of a million reasons.
But the finger points first at ZM for screwing around with our source address. You broke it, that's very clear: but can you put it back together again? What happened to my special characters?"
But as well as the public relations disaster, there is a good technical reason why you should not do this. It's simply another good opportunity for something to go wrong. Maybe a special character does get lost. Maybe it's older equipment that does not follow the rules.
If you want to pluck out my password and username fine, but please don't rewrite my requests: I fought hard to find them and they worked fine before YOU GUYS came along and started screwing around with them.
That's just CREEPY!
That's the perception, anyway.
If security is a concern, maybe use your powers of parsing to ****** the password upon presentation to the user, or treat the whole URL as a secret.