Old Vidme embeds turn into porn after domain purchase

https://www.theverge.com/2021/7/22/22589403/porn-site-bought-expired-video-hosting-site-old-embeds

by ibaikov • 5 years ago

203 121 5 years ago

sp3325• 5 years ago

4 years ago, Archive Team backed up "nearly all" of Vidme (according to Jason Scott). It was uploaded to the Internet Archive here https://archive.org/details/archiveteam_vidme so you can fix your vid.me URLs by pointing them to the Archive.

(And you can help keep them there, too https://archive.org/donate But honestly, using the Archive more keeps the bigger donors involved, so don't feel guilty or anything. Just use the Archive!)

ibaikov• 5 years ago

Oh that's clever, I totally forgot about this. Archive is amazing.

toomuchtodo3• 5 years ago

Not all public goods are flashy, but most are necessary.

swiley• 5 years ago

That really is an amazing organization.

1vuio0pswjnm7• 5 years ago

There should be more than one archive.org

Why not. Is it really impossible

I read a significant percentage of HN submissions through archive.org. Saves me DNS lookups. Recent pages look exactly the same to me as their "live" versions, the retrieval time is rarely bad.^1

Its probably the best "CDN" as it has the largest amount and variety of content

There should be more than one archive.org (and more than one ArchiveTeam). These projects work and they are standing the test of time. archive.org is older than Google. Much, much older in "internet time".

1. I use a text-only browser though so not sure how tolerable it would through Javascript-enabled graphical browser

Scoundreller3• 5 years ago

So uhhhh, anyone want to write the recursive replacement regex that'll do that across an entire filesystem?

lallysingh• 5 years ago

find | xargs awk?

danso• 5 years ago

The search results counter is 12,385...is that really all (or "nearly all") of what Vid.me had for content? I mean I know it failed at dethroning Youtube, but 12,000+ videos is barely anything.

boomboomsubban• 5 years ago

That's roughly one hour of new uploads on YouTube as of 2016.

oxguy3• 5 years ago

It looks like each of those 12,385 items is a big 10.4GB archive of thousands of videos.

tech234a2• 5 years ago

That is the number of megawarc items. Each one of these items contains many videos.

Scoundreller3• 5 years ago

weird flex, but I needed to get over a threshold to 'earn' a credit card promo for spending enough, and a donation here will do it!

(It's too bad the tax deduction isn't eligible in Canada :( )

alexjplant• 5 years ago

I have the opposite problem... I give money to OpenBSD but can't claim it on my taxes since they're Canadian :-(.

Causality12• 5 years ago

I wish they'd been doing that when Google Video shut down. Lost a lot of good content I didn't download.

tech234a2• 5 years ago

They did: https://wiki.archiveteam.org/index.php/Google_Video

sp3325• 5 years ago

I helped download a few gigs of Google Video at the time, so I know some of it is up there.

oakwhiz2• 5 years ago

Very amusing but I take issue with the article's claim that "Here’s (yet another) argument against using third-party embeds" - this might be an oversimpified perspective when it's actually a good argument to use subresource integrity (essentially cryptographic pinning of third party embedded content). I am unsure if this extends to every kind of resource that you could have in a web page, (ideally it should) but I could imagine a JS shim being used to cover some edge cases.

sp3325• 5 years ago

Subresource integrity would prevent the porn from showing up, but the videos would still be broken. Hosting the videos yourself is the option that would keep things running.

oakwhiz2• 5 years ago

True, and HTML5 video tends to "just work," however I've found that many people have practical issues with hosting their own video. For example, not understanding video conversion, hosting behind bandwidth or request rate limitations, or not having anycast/CDN set up to hold the site together when a page unexpectedly goes viral. There are reasons that hosting videos yourself might not be an effective use of the resources or time available to you, especially based on technical skills, in which case third party hosting with pinning remains a better option.

jandrese2• 5 years ago

Video embeds tend to be especially fragile however since they're often implemented by gluing together a relatively large number of third party services. Any one of the services goes down or changes the API and the whole thing breaks.

Ask any uMatrix user how much fun it is to get a video to play on some websites and just how much external crap you have to allow before you see the first frame.

S_A_P• 5 years ago

That and Facebook container. I could not get slack to work until I allowed slack access to Facebook because I had to re-authenticate. Even though I don’t use Facebook I have to allow slack to access it at least to be able to authenticate to a different authentication source.

AkshitGarg• 5 years ago

Genuinely curious, how does a company manage their domains after they shut down their services to prevent this kind of stuff

cyberge99• 5 years ago

I would think the same way a person would posthumously: let it expire and let natural order take over or delegate ownership via legal/custodial means.

Sorry that doesn’t answer your question more than “it depends on the entity”.

tyingq2• 5 years ago

You could pre-pay for X years, where X is long enough to ensure you'll be dead when it expires.

Edit: Seems like there's a 10 year limit in many places? I wonder if that's broad convention or an actual rule.

Okay, apparently an ICANN limit for .com domains:

"The expiration date of the domain registration is extended by the number of years, up to a maximum of ten years, as specified by the Registrar's requested Extend operation."

https://www.icann.org/en/registry-agreements/com/com-registr...

Though, I can see that navy.us has an expiry in 2053, so it's likely per registry.

tqkxzugoaupvwqr• 5 years ago

I can at most pay for 10 years in advance. Is this a limit of my registrar?

rootusrootus2• 5 years ago

Aren't most domains limited to 10 years max?

_jal2• 5 years ago

Network Solutions will sell you service for 100 years.

Edit: CSC, Markmonitor and similar shops will contract to keep your name available for long periods, too, but that's a bit different.

yupper32• 5 years ago

For me I feel like a 10 year pre-pay would be worse. I'll forget about the fact that I need to pay for it again in 2031.

Yearly at least keeps me on my toes a bit.

foxpurple• 5 years ago

They don’t. They have shut down. Why would they care what happens?

TekMol3• 5 years ago

Domains are an area where blockchain technology could help a lot.

A domain could cost a fixed amount of X per month. So you could pay 100 years upfront and be sure to not lose it in that timeframe.

To move a domain,the registrar and the owner could have to sign the move. So it would not be possible anymore to lose a domain due to the regsitrar making a mistake.

jazzyjackson• 5 years ago

“ethereum name service” is doing this and honestly aside from gas fees it’s not a bad price for permanent real estate (as permanent as the ethereum virtual machine at least)

mdoms• 5 years ago

Can you explain in detail what problem blockchain solves here and why it can't be solved without blockchain?

floren• 5 years ago

Well, if it's solved via blockchain, there's an opportunity for speculation among early adopters, which I think is the major selling point for most blockchain "solutions"

TekMol3• 5 years ago

The problem that someone else can move your domain.

The same problem it solves for finance: That someone else can move your money.

ignitionmonkey4• 5 years ago

We can't and shouldn't expect people to keep their old domains forever. We need a way for pages to be signed and hyperlinks to enforce authorship. When we link to stuff, we should have a way to say whose stuff we're linking to. It's no different from installing signed software and using trusted repositories.

This is one of the reasons I created a proof-of-concept web extension that verifies links and pages using PGP. On a mismatch, it flags the page and offers a web archive link instead.

https://webverify.jahed.dev/

It was pretty fun to make, but currently due to performance, Web Extensions API doesn't provide the features to do this perfectly. Firefox provides just about enough additional APIs to hack it together.

alisonkisk2• 5 years ago

Also, Signed Exchanges for CDNs.

https://developers.google.com/web/updates/2018/11/signed-exc...

LinuxBender2• 5 years ago

Could SRI be used for this? [1]

[1] https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

ignitionmonkey4• 5 years ago

SRI/hashing works for static content. Though it's worth mentioning it's a SUB-resource feature (images, scripts, etc.). It doesn't work for hyperlinks to other pages. Even if it did, it's a different use case.

Say I link to an article by Author A that has comments in it (or even a footer, relative timestamp, sidebar, etc.). Hashing won't work as the page is always changing. I want the link to always go to Author A but I don't care if the content changes. That's the sort of use case signed webpages and hyperlinks with enforced authorship covers. It's less about what's on the page and more about who created it.

beambot• 5 years ago

One solution is to have a unique URI per file that is independent of DNS. Decentralized file storage (e.g. FileCoin / IPFS) might serve this purpose...

ignitionmonkey4• 5 years ago

Definitely but I think we need something that will work with the web we currently have while these bigger ideas are fleshed out and adopted.

Also, while IPNS covers the issue of linking to dynamic content, it's worth mentioning IPFS will have similar issues with DNS as DNSLink and similar domain-driven solutions are used to cover its usability issues (long, random URIs).

elihu• 5 years ago

One idea that's been around for awhile is to identify files by their hash. That has pros and cons. The good side of that is that the file is immutable; you can't accidentally link to something else unless someone can manufacture a hash collision somehow. The down side is that if the file is corrected in some way, you don't get the fixes.

In a lot of the peer-to-peer distributed hash table designs, all you need to retrieve a file is its hash.

https://en.wikipedia.org/wiki/Content_addressable_network

kazinator5• 5 years ago

Problem is, you have to download the entire video to check the hash. That's not how video embedding works; the client browser is just handed some link, and it obtains pieces of the video, rendering it instantly.

Basically, little segments of the video have to have a signature which is continuously validated. Or something like that.

ohyeshedid• 5 years ago

Sounds like something subresource integrity[1] could be expanded to include.

[1] https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

anfilt• 5 years ago

This is were a signature would come in handy, if you want the resource to be updated. Just keep track that it was signed by the same private key.

ff7c11• 5 years ago

I had a personal project that I got bored with so I let the domain expire. Then I got emails from former users saying that the domain was now hosting malware. So yeah I would like it for all the old links to the site to somehow know that the owner has changed. Not sure what a reasonable solution would look like though.

strogonoff2• 5 years ago

Could URL authorship confirmation be implemented on top of TLS? If someone takes over a domain, the final certificate in the chain will be issued to another entity, and that could be enough to trigger a notice. Could be achievable with a centralized registry/crawler like Internet Archive, but one that only keeps track of domain:certificate mapping.

Of course, the devil’s in the details (infrastructure/organizational changes can trigger false positives; shared hosting setup can cause false negatives; it presumes that if the original entity abandons a domain they’d revoke the cert; etc.), but IMO it wouldn’t be worthless as it is.

account422• 5 years ago

Most certificates (including all free ones) are domain validated only so the entity being certified is just the domain and will not change with a new owner.

paulddraper• 5 years ago

It's not a solvable problem.

Domains need to be short to be memorized, which makes them scare and valuable.

And having two forms of URLs is undesirable; just look at AMP.

vernie• 5 years ago

Any discussion beyond "lol damn" is unnecessary.

mindslight• 5 years ago

There were non-porn videos on the original vid.me? TIL.

nanis• 5 years ago

I guess I submitted too early :-) https://news.ycombinator.com/item?id=27925605

anigbrowl2• 5 years ago

What's the win for the new owner, do they make money from linking to the porn somehow? Sure it could also be just for lulz but there are many equally or more lulzy possibilities whereas porn often seems to be coupled with economic gain.

dragonwriter2• 5 years ago

What's the win for the new owner, do they make money from linking to the porn somehow?

They are the porn (the new owner is a porn firm), so, yes. I haven't seen the actual linked content, but I assume its something like free samples with directions telling people where to get more; its a move that gets porn ads placed for free in a lot of places that would never choose to allow porn ads.

anigbrowl2• 5 years ago

Thanks, I didn't find it clear from the article and had no desire to go looking for content.

nerdponx• 5 years ago

It might also be an accident, if all the embeds are iframes that redirect to the homepage.

dredmorbius• 5 years ago

The trend toward embeds rather than screenshots or direct copying has long struck me as ill-conceived.

At least it's only pr0n. As a vector for malware / spyware injection, this could be even more interesting.

Relevant xkcd, of course: https://xkcd.com/1698/

h/t Elda King @ Mastodon https://weirder.earth/@eldaking/106626603001624730

jtvjan• 5 years ago

I'd get it if it was Goatse, but this is just regular porn. If they simply wanted to earn money from ads, serving something more milquetoast would make more sense, because now there's a rush to remove old embeds.

Why?!

vmception• 5 years ago

Now everyone know about it and vidme’s ad space is more valuable

Genius

bitwize• 5 years ago

serving something more milquetoast

Never gonna give you up...

jobigoud2• 5 years ago

They just bought the domain they are not actively serving the embeds URLs.

kazinator5• 5 years ago

Here’s (yet another) argument against using third-party embeds on your respectable website

Well, it's an argument against using embeds without having any way to validate their authenticity.

This is analogous to having a software distro (e.g. package manager) which downloads upstream tarballs or git repos without checking any hashes.

Is there a solution for this? Say you want to embed a video from some third party sites; what tools are there for ensuring that the embedding will somehow lapse if the video at that URL has been replaced or altered?

Ideally, you'd be notified if that happened. While not showing porn is good, but videos not working is bad. You can't be checking an entire site all the time for non-working external content.

thaumasiotes• 5 years ago

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

one_off_comment2• 5 years ago

The weird thing about this to me is, the company or person who scooped up the domain... in order to get their plan working so quickly, wouldn't they have had to set up a site perfectly beforehand so the embeds would work as desired and then just sat there waiting, hoping, ready to hit the button to scoop up the domain at just the right time, praying nobody beat them to it?

Isn't that a lot of work for almost no gain?

dec0dedab0de• 5 years ago

depending on how vidme stored their videos it could just be as simple as returning any request for a video file with whatever they were showing.

duskwuff2• 5 years ago

The embeds don't actually "work", per se. When the browser tries to load the embed into an <iframe>, it gets redirected to the home page of the porn site, and ends up displaying the upper left corner of that page in the space where the video embed was supposed to go. It all looks rather more accidental than purposeful.

one_off_comment2• 5 years ago

Ah, good to know. That explains it. I feel like this aspect was lost in reporting this. It was all made to sound much more deliberate.

edoceo2• 5 years ago

One of the services I've sold more than once was to handle the "offlining" of a domain. Basically provide a 307/404/410 service and make sure it works for a long time before the name gets released. Basically to help clean up on the way out.

amatecha3• 5 years ago

why 307 (temporary) and not 308 (permanent)? (curious about this as when I used to work on a ton of company websites and migrate from old sites, there'd always be a big process of setting up a ton of 301 (permanent) redirects)

kosayoda• 5 years ago

As both the post topic and the parent comment topic are about domain changes, wouldn't that basically direct users of the old site on the domain to a totally different domain when they want to access the new site on the same domain?

edoceo2• 5 years ago

Sorry, just a typo from the brain. It's a config option - with a few in the 300 series, mostly choosing a permanent option

S-E-P• 5 years ago

That’s kind of hilarious but gross all at the same time

paulpauper• 5 years ago

Or 3rd party JS libraries. instead of https://code.jquery.com/, your admin 'accidentally' added https://code.jqeury.com/ which embeds a crypto miner

sideproject• 5 years ago

I use Domainy

https://www.domainy.io

to monitor interesting domains being expired and to also find interesting domains that are available.

twitter.accountant? what about twitter.beauty?

Domains are not exactly available when they expire, but this helps me to check if any of them become available.

skibby• 5 years ago

I can't even imagine the amount of exposure to minors this has caused. But that's nothing new for the porn industry.

alisonkisk2• 5 years ago

Why isn't this considered criminal vandalism and hacking? Intent matters.

Owning the domain doesn't give them a right to intentionally interfere with the requested content; they should simply decline to serve the expired URLs.

jobigoud2• 5 years ago

Based on another comment it's what they do. The dead URLs are redirected to their main page which gets embedded in place of the original videos. I don't think they should inherit the maintenance cost of the incoming links, as long as they are not maliciously swapping the content.