4 ms·

It has a strange bug, where if you visit it with HTTPS, none of the songs load. They could just use letsencrypt.

ryannevius 7y ago
"It's not a bug, it's a feature" of most modern web browsers. A https page that includes content fetched using http is called a "mixed content" page. Radiooooo over https still fetches the songs via http requests, and so many browsers block these requests.
- DyslexicAtheist 7y ago
  that's a no thanks for me. allowing mixed_content isn't something I can live with.
  - p49k 7y ago
    It’s for listening to clips of old music, not email or banking. It’s literally replicating data that is otherwise being publicly broadcast through the air unencrypted.
    - rkagerer 7y ago
      But his ISP might be injecting subliminal messages! (For fun see also https://en.m.wikipedia.org/wiki/Backmasking https://en.m.wikipedia.org/wiki/Backmasking)
      - DyslexicAtheist 7y ago
        my ISP doesn't do this currently. reason is actually that I don't see any reason why the app should be using mixed_content to begin with. In the age of letsencrypt you can easily get certificates, so the only reasons I can think of are a) performance overhead due to TLS, b) storage of audio tracks done on 3rd party domains due to cost/limits. a) is a non-issue in 2020 b) not extending trust to 3rd party domains is literally why allowing mixed_content is a terrible idea
        drewg123 7y ago
        TLS is anything but a non-issue. TLS accounts for roughly 40% of the CPU and 45% of the memory bandwidth on our CDN nodes. I work for Netflix on our CDN. I wrote much of the FreeBSD kernel TLS layer, and am working with several vendors on hardware TLS offload to eliminate this overhead. Hopefully your statement will be correct soon :)
        DyslexicAtheist 7y ago
        I agree that you have compute overhead which you need to account for. At least for SaaS companies it's not really a technical hurdle that blocks anyone from running their service, except maybe for those who are already very large (Netflix obvioulsy) and have scaled and optimized so well that it makes sense for further reducing this additional cost. You're in a unique position I think and you are lucky to work on a cool project like this. But I have not seen any places where this was at all an urgent on a clients or employers agenda. It is a budgeting issue (if you're buying) or pricing issue (if you're selling), but it's not an technical problem that needs to be solved in any place other than hyper-scaling companies/stacks. Terminating TLS and (load-balancing it) is not really what prevents a cash strapped start-up from scaling, nor is it super high priority in large companies who are able to throw a little extra money at this problem. Those companies who still have skilled innovators around solves the problem like you do at Netflix, in older industries (banks come to mind) they just by OTS or have a consulting company implement some "bespoke solution". It's a "problem" most SaaS businesses can carry with them for a long time, until they have room to address it. obviously this sounds like a cool project to dive into but quite rare too! enjoy it, I know I would :)
    - DyslexicAtheist 7y ago
      I get that. but how would you allow the mixed content on a per site basis? sure I could use another browser that ignores the security just for this one page. how else would you do it without editing about:config and then switching back, is there a extension or something that can do that on a per-site basis? It's a shame this isn't working in a secure way and out of the box on modern browsers.
- benjaminmoreau 7y ago
  use this new adress: https://radiooooo.app https://radiooooo.app it fix a lot of bugs !
  - DyslexicAtheist 7y ago
    works like a charm, thanks this site is pure awesome
infide1castr0 7y ago
I have been wondering why it stopped working for me half the time about a year and a half ago, and you just now made that click in my head haha, cheers for that.
deleted 7y ago
[deleted]

"It's not a bug, it's a feature" of most modern web browsers. A https page that includes content fetched using http is called a "mixed content" page. Radiooooo over https still fetches the songs via http requests, and so many browsers block these requests.

DyslexicAtheist 7y ago
that's a no thanks for me. allowing mixed_content isn't something I can live with.
- p49k 7y ago
  It’s for listening to clips of old music, not email or banking. It’s literally replicating data that is otherwise being publicly broadcast through the air unencrypted.
  - rkagerer 7y ago
    But his ISP might be injecting subliminal messages! (For fun see also https://en.m.wikipedia.org/wiki/Backmasking https://en.m.wikipedia.org/wiki/Backmasking)
    - DyslexicAtheist 7y ago
      my ISP doesn't do this currently. reason is actually that I don't see any reason why the app should be using mixed_content to begin with. In the age of letsencrypt you can easily get certificates, so the only reasons I can think of are a) performance overhead due to TLS, b) storage of audio tracks done on 3rd party domains due to cost/limits. a) is a non-issue in 2020 b) not extending trust to 3rd party domains is literally why allowing mixed_content is a terrible idea
      - drewg123 7y ago
        TLS is anything but a non-issue. TLS accounts for roughly 40% of the CPU and 45% of the memory bandwidth on our CDN nodes. I work for Netflix on our CDN. I wrote much of the FreeBSD kernel TLS layer, and am working with several vendors on hardware TLS offload to eliminate this overhead. Hopefully your statement will be correct soon :)
        DyslexicAtheist 7y ago
        I agree that you have compute overhead which you need to account for. At least for SaaS companies it's not really a technical hurdle that blocks anyone from running their service, except maybe for those who are already very large (Netflix obvioulsy) and have scaled and optimized so well that it makes sense for further reducing this additional cost. You're in a unique position I think and you are lucky to work on a cool project like this. But I have not seen any places where this was at all an urgent on a clients or employers agenda. It is a budgeting issue (if you're buying) or pricing issue (if you're selling), but it's not an technical problem that needs to be solved in any place other than hyper-scaling companies/stacks. Terminating TLS and (load-balancing it) is not really what prevents a cash strapped start-up from scaling, nor is it super high priority in large companies who are able to throw a little extra money at this problem. Those companies who still have skilled innovators around solves the problem like you do at Netflix, in older industries (banks come to mind) they just by OTS or have a consulting company implement some "bespoke solution". It's a "problem" most SaaS businesses can carry with them for a long time, until they have room to address it. obviously this sounds like a cool project to dive into but quite rare too! enjoy it, I know I would :)
  - DyslexicAtheist 7y ago
    I get that. but how would you allow the mixed content on a per site basis? sure I could use another browser that ignores the security just for this one page. how else would you do it without editing about:config and then switching back, is there a extension or something that can do that on a per-site basis? It's a shame this isn't working in a secure way and out of the box on modern browsers.
benjaminmoreau 7y ago
use this new adress: https://radiooooo.app https://radiooooo.app it fix a lot of bugs !
- DyslexicAtheist 7y ago
  works like a charm, thanks this site is pure awesome

infide1castr0 7y ago

I have been wondering why it stopped working for me half the time about a year and a half ago, and you just now made that click in my head haha, cheers for that.

deleted 7y ago

[deleted]