Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Old Vidme embeds turn into porn after domain purchase

theverge.com

Post reply on HN
Print view View original

81–90 of 125 posts

Re: Old Vidme embeds turn into porn after domain purchase

#81

Post by anigbrowl »

dragonwriter wrote: post #53
anigbrowl wrote: post #46

What's the win for the new owner, do they make money from linking to the porn somehow? Sure it could also be just for lulz but there are many equally or more lulzy possibilities whereas porn often seems to be coupled with economic gain.

> What's the win for the new owner, do they make money from linking to the porn somehow? They are the porn (the new owner is a porn firm), so, yes. I haven't seen the actual linked content, but I assume its something like free samples with directions telling people where to get more; its a move that gets porn ads placed for free in a lot of places that would never choose to allow porn ads.

Thanks, I didn't find it clear from the article and had no desire to go looking for content.

Re: Old Vidme embeds turn into porn after domain purchase

#82

Post by tomjakubowski »

skipants wrote: post #62
kazinator wrote: post #59

Earlier quoted context omitted.

Problem is, you have to download the entire video to check the hash. That's not how video embedding works; the client browser is just handed some link, and it obtains pieces of the video, rendering it instantly. Basically, little segments of the video have to have a signature which is continuously validated. Or something like that.

I don't have expertise in video codecs or file formats, but couldn't you hash the first N bytes of a stream? Stream those N bytes to the client and if it matches start the video, else stop the download and not start the video.

If you only hash/check the first N bytes of the video stream, the remainder of the video could be anything.

Re: Old Vidme embeds turn into porn after domain purchase

#83

Post by alexjplant »

Scoundreller wrote: post #19
sp332 wrote: post #2

4 years ago, Archive Team backed up "nearly all" of Vidme (according to Jason Scott). It was uploaded to the Internet Archive here https://archive.org/details/archiveteam_vidme so you can fix your vid.me URLs by pointing them to the Archive. (And you can help keep them there, too https://archive.org/donate But honestly, using the Archive more keeps the bigger donors involved, so don't feel guilty or anything. Just us…

weird flex, but I needed to get over a threshold to 'earn' a credit card promo for spending enough, and a donation here will do it! (It's too bad the tax deduction isn't eligible in Canada :( )

I have the opposite problem... I give money to OpenBSD but can't claim it on my taxes since they're Canadian :-(.

Re: Old Vidme embeds turn into porn after domain purchase

#84

Post by darrylb42 »

alexjplant wrote: post #83
Scoundreller wrote: post #19

Earlier quoted context omitted.

weird flex, but I needed to get over a threshold to 'earn' a credit card promo for spending enough, and a donation here will do it! (It's too bad the tax deduction isn't eligible in Canada :( )

I have the opposite problem... I give money to OpenBSD but can't claim it on my taxes since they're Canadian :-(.

Are they a registered non-profit now? I donated when I used OpenBSD but don't think I got a tax receipt, just my name on one of the releases.

Re: Old Vidme embeds turn into porn after domain purchase

#85

Post by grapehut »

kazinator wrote: post #59
elihu wrote: post #48

Earlier quoted context omitted.

One idea that's been around for awhile is to identify files by their hash. That has pros and cons. The good side of that is that the file is immutable; you can't accidentally link to something else unless someone can manufacture a hash collision somehow. The down side is that if the file is corrected in some way, you don't get the fixes. In a lot of the peer-to-peer distributed hash table designs, all you need to ret…

Problem is, you have to download the entire video to check the hash. That's not how video embedding works; the client browser is just handed some link, and it obtains pieces of the video, rendering it instantly. Basically, little segments of the video have to have a signature which is continuously validated. Or something like that.

That's not really a problem. You don't hash the entire video, but do something resembling a merkle tree. i.e. look at a torrent, they're identified by a hash but you can download and verify a random chunk

Re: Old Vidme embeds turn into porn after domain purchase

#86

Post by duskwuff »

one_off_comment wrote: post #57

The weird thing about this to me is, the company or person who scooped up the domain... in order to get their plan working so quickly, wouldn't they have had to set up a site perfectly beforehand so the embeds would work as desired and then just sat there waiting, hoping, ready to hit the button to scoop up the domain at just the right time, praying nobody beat them to it? Isn't that a lot of work for almost no gain?

The embeds don't actually "work", per se. When the browser tries to load the embed into an , it gets redirected to the home page of the porn site, and ends up displaying the upper left corner of that page in the space where the video embed was supposed to go. It all looks rather more accidental than purposeful.

Re: Old Vidme embeds turn into porn after domain purchase

#87

Post by kazinator »

skipants wrote: post #62
kazinator wrote: post #59

Earlier quoted context omitted.

Problem is, you have to download the entire video to check the hash. That's not how video embedding works; the client browser is just handed some link, and it obtains pieces of the video, rendering it instantly. Basically, little segments of the video have to have a signature which is continuously validated. Or something like that.

I don't have expertise in video codecs or file formats, but couldn't you hash the first N bytes of a stream? Stream those N bytes to the client and if it matches start the video, else stop the download and not start the video.

They will keep the first few seconds or minutes of the original video, bit-exact, and then switch to porn. The player needs to validate every section.

Re: Old Vidme embeds turn into porn after domain purchase

#88

Post by kazinator »

nextlevelwizard wrote: post #64
kazinator wrote: post #59

Earlier quoted context omitted.

Problem is, you have to download the entire video to check the hash. That's not how video embedding works; the client browser is just handed some link, and it obtains pieces of the video, rendering it instantly. Basically, little segments of the video have to have a signature which is continuously validated. Or something like that.

Assuming there is no malicious intent behind the embeds you could have the hash in the header of the video.

I think that in the context of the topic of this submission "replacement by porn" is being regarded as malicious intent.

Re: Old Vidme embeds turn into porn after domain purchase

#89

Post by kazinator »

grapehut wrote: post #85
kazinator wrote: post #59

Earlier quoted context omitted.

Problem is, you have to download the entire video to check the hash. That's not how video embedding works; the client browser is just handed some link, and it obtains pieces of the video, rendering it instantly. Basically, little segments of the video have to have a signature which is continuously validated. Or something like that.

That's not really a problem. You don't hash the entire video, but do something resembling a merkle tree. i.e. look at a torrent, they're identified by a hash but you can download and verify a random chunk

Right, merkle tree! OK, so the embedding site only stores a single hash: the root one. This hashes the the remaining hashes. The first thing we fetch from the video is those hashes and if their hash doesn't match, we flag/ignore the video and refuse to play.

Multiple levels of the tree can be stored throughout the video file. The first level after the root can be for major sections, like 5 minute segments. The next levels are then at the start of each 5 minute segment, giving hashes for one second chunks.

If the root hash checks out, we get the 5-min hashes. If they check out, we get the hashes for the first 5-min block, and if those hashes check out, we start to play the video, validating every second of it against a one second hash from the 5 min block. Then we get the next 5-min hash block and so on.

Kind of thing.

Re: Old Vidme embeds turn into porn after domain purchase

#90

Post by giantrobot »

skipants wrote: post #62
kazinator wrote: post #59

Earlier quoted context omitted.

Problem is, you have to download the entire video to check the hash. That's not how video embedding works; the client browser is just handed some link, and it obtains pieces of the video, rendering it instantly. Basically, little segments of the video have to have a signature which is continuously validated. Or something like that.

I don't have expertise in video codecs or file formats, but couldn't you hash the first N bytes of a stream? Stream those N bytes to the client and if it matches start the video, else stop the download and not start the video.

This has a number of problems.

The most egregious is if I'm an attacker and I have the file you request I can hash the appropriate portion you'd use to verify it but fill the rest with junk or exploits. You'd receive the file, it would emit the correct hash, yet be not what you were expecting.

For video especially what you receive isn't necessarily predictable by the client. With HLS or MPEG DASH streaming the video you receive could be one of a number of different encoding e.g. lower or higher bitrates to deal with changing network conditions. The actual m3u8/mpd file you might receive could change arbitrarily as the video provider adds or drops different encodings. The hash of such a file today isn't guaranteed to match the hash tomorrow for entirely banal non-malicious reasons.

Fun fact: the UUHash algorithm used by the FastTrack network (Kazaa, Morpheus, etc) only hashed the first bit of a file. Hashing a large file took forever on hardware of the day. Even hashing small files was non-trivial. The RIAA through various fronts would insert spoofed files where the first portion of the file was legitimate but the content of the file would be junk or annoying sounds. The files would be named like any other MP3 someone was searching for and even have seemingly good IDv3 tags.

Post reply on HN