[Galene] Re: Blur background

[Juliusz Chroboczek <jch@irif.fr>]

Hello Francis,

I'd really like to have background blur in Galene, but I don't see any
good way to do it without impairing the user's privacy.

> +    <script src="https://cdn.jsdelivr.net/npm/set-interval-async"></script>
> +    <script src="https://cdn.jsdelivr.net/npm/@tensorflow/tfjs-core"
> defer></script>
> +    <script src="https://cdn.jsdelivr.net/npm/@tensorflow/tfjs-backend-webgl"
> defer></script>
> +    <script src="https://cdn.jsdelivr.net/npm/@tensorflow-models/body-segmentation/dist/body-segmentation.js"
> defer></script>
> +    <script src="https://cdn.jsdelivr.net/npm/@mediapipe/selfie_segmentation"
> defer></script>

That's problematic.  One of the design criteria of Galene is that it
preserves the user's privacy.  These links imply that everytime somebody
connects to any instance of Galene in the workld, the jsdelivr.net
distribution network is informed of the fact.

So either we bundle all the scripts in Galene, or this cannot go in.

>  async function start() {
> +
> +    offscreen = new OffscreenCanvas(1920, 1080);
> +
> +    segmenter = await bodySegmentation.createSegmenter(
> +        bodySegmentation.SupportedModels.MediaPipeSelfieSegmentation,
> +        {
> +            runtime: 'mediapipe',
> +            solutionPath:
> 'https://cdn.jsdelivr.net/npm/@mediapipe/selfie_segmentation',
> +            modelType: 'general'
> +        }
> +    );

This should be done lazily, in the filter, not at startup.

> +    w.Header().Set("Access-Control-Allow-Origin", "*")
> +    w.Header().Set("Access-Control-Allow-Methods", "GET")
> +    w.Header().Set("Access-Control-Allow-Headers", "Content-Type")

That's a potential security hole, since it makes Galene vulnerable to
cross-origin scripting attacks.  What we do in Galene is to only set these
headers conditionally, in places that are known to be safe.  See for example

  https://github.com/jech/galene/blob/master/webserver/whip.go#L178

-- Juliusz