Old Vidme embeds turn into porn after domain purchase • Hacker News Board

Re: Old Vidme embeds turn into porn after domain purchase

#101

Post by dragonwriter » Fri, Jul 23, 2021, 11:56 PM UTC

giantrobot wrote: post #90

skipants wrote: post #62

Earlier quoted context omitted.

I don't have expertise in video codecs or file formats, but couldn't you hash the first N bytes of a stream? Stream those N bytes to the client and if it matches start the video, else stop the download and not start the video.

This has a number of problems. The most egregious is if I'm an attacker and I have the file you request I can hash the appropriate portion you'd use to verify it but fill the rest with junk or exploits. You'd receive the file, it would emit the correct hash, yet be not what you were expecting. For video especially what you receive isn't necessarily predictable by the client. With HLS or MPEG DASH streaming the video…

> Fun fact: the UUHash algorithm used by the FastTrack network (Kazaa, Morpheus, etc) only hashed the first bit of a file.

The first 300KiB plus a series of 300KiB chunks at exponentially-increasing offsets, per Wikipedia. But still a small fraction of thw file.

Re: Old Vidme embeds turn into porn after domain purchase

#102

Post by lelandbatey » Sat, Jul 24, 2021, 12:14 AM UTC

kazinator wrote: post #89

grapehut wrote: post #85

Earlier quoted context omitted.

That's not really a problem. You don't hash the entire video, but do something resembling a merkle tree. i.e. look at a torrent, they're identified by a hash but you can download and verify a random chunk

Right, merkle tree! OK, so the embedding site only stores a single hash: the root one. This hashes the the remaining hashes. The first thing we fetch from the video is those hashes and if their hash doesn't match, we flag/ignore the video and refuse to play. Multiple levels of the tree can be stored throughout the video file. The first level after the root can be for major sections, like 5 minute segments. The next l…

In actual HLS streaming videos are served in 2-10 second segments, a size small enough that you realistically can hash each segment and verify each segment. Youd have to implement it as an extension of the HLS protocol, so probably as m3u8 with additional fields, maybe as comments.

Re: Old Vidme embeds turn into porn after domain purchase

#103

Post by sp332 » Sat, Jul 24, 2021, 12:19 AM UTC

sp332 wrote: post #71

Causality1 wrote: post #50

Earlier quoted context omitted.

I wish they'd been doing that when Google Video shut down. Lost a lot of good content I didn't download.

I helped download a few gigs of Google Video at the time, so I know some of it is up there.

Late edit: never mind, that was Yahoo video.

Re: Old Vidme embeds turn into porn after domain purchase

#104

Post by tzs » Sat, Jul 24, 2021, 1:23 AM UTC

tyingq wrote: post #23

tqkxzugoaupvwqr wrote: post #20

Earlier quoted context omitted.

I can at most pay for 10 years in advance. Is this a limit of my registrar?

On mine, I can pay for up to 10 years, but I think I can just pay twice and get 20. Edit: It seems to vary. Some places cite an ICANN limit of 10 years.

10 years is the ICANN limit but Network Solutions offers 100 years. According to the fine print what they do is actually register it for 10 years and then every year for the next 90 years they register it for an additional year.

They are betting that they will earn more than enough from investing your up front 100 year payment to more than cover future increases in the cost of those one year extensions.

Their customers are betting that Network Solutions or some successor will be around long enough and that domain names will work like the do now long enough that this will be worth it.

Re: Old Vidme embeds turn into porn after domain purchase

#105

Post by thaumasiotes » Sat, Jul 24, 2021, 2:15 AM UTC

kazinator wrote: post #56

> Here’s (yet another) argument against using third-party embeds on your respectable website Well, it's an argument against using embeds without having any way to validate their authenticity. This is analogous to having a software distro (e.g. package manager) which downloads upstream tarballs or git repos without checking any hashes. Is there a solution for this? Say you want to embed a video from some third party s…

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

Re: Old Vidme embeds turn into porn after domain purchase

#106

Post by strogonoff » Sat, Jul 24, 2021, 5:20 AM UTC

ignitionmonkey wrote: post #13

We can't and shouldn't expect people to keep their old domains forever. We need a way for pages to be signed and hyperlinks to enforce authorship. When we link to stuff, we should have a way to say whose stuff we're linking to. It's no different from installing signed software and using trusted repositories. This is one of the reasons I created a proof-of-concept web extension that verifies links and pages using PGP.…

Could URL authorship confirmation be implemented on top of TLS? If someone takes over a domain, the final certificate in the chain will be issued to another entity, and that could be enough to trigger a notice. Could be achievable with a centralized registry/crawler like Internet Archive, but one that only keeps track of domain:certificate mapping.

Of course, the devil’s in the details (infrastructure/organizational changes can trigger false positives; shared hosting setup can cause false negatives; it presumes that if the original entity abandons a domain they’d revoke the cert; etc.), but IMO it wouldn’t be worthless as it is.

Re: Old Vidme embeds turn into porn after domain purchase

#107

Post by alisonkisk » Sat, Jul 24, 2021, 5:43 AM UTC

Why isn't this considered criminal vandalism and hacking? Intent matters.

Owning the domain doesn't give them a right to intentionally interfere with the requested content; they should simply decline to serve the expired URLs.

Re: Old Vidme embeds turn into porn after domain purchase

#108

Post by jobigoud » Sat, Jul 24, 2021, 6:28 AM UTC

alisonkisk wrote: post #107

Why isn't this considered criminal vandalism and hacking? Intent matters. Owning the domain doesn't give them a right to intentionally interfere with the requested content; they should simply decline to serve the expired URLs.

Based on another comment it's what they do. The dead URLs are redirected to their main page which gets embedded in place of the original videos. I don't think they should inherit the maintenance cost of the incoming links, as long as they are not maliciously swapping the content.

Re: Old Vidme embeds turn into porn after domain purchase

#109

Post by jobigoud » Sat, Jul 24, 2021, 6:35 AM UTC

jtvjan wrote: post #51

I'd get it if it was Goatse, but this is just regular porn. If they simply wanted to earn money from ads, serving something more milquetoast would make more sense, because now there's a rush to remove old embeds. Why?!

They just bought the domain they are not actively serving the embeds URLs.

Re: Old Vidme embeds turn into porn after domain purchase

#110

Post by amatecha » Sat, Jul 24, 2021, 7:17 AM UTC

edoceo wrote: post #63

One of the services I've sold more than once was to handle the "offlining" of a domain. Basically provide a 307/404/410 service and make sure it works for a long time before the name gets released. Basically to help clean up on the way out.

why 307 (temporary) and not 308 (permanent)? (curious about this as when I used to work on a ton of company websites and migrate from old sites, there'd always be a big process of setting up a ton of 301 (permanent) redirects)