16 ms·

Old Vidme embeds turn into porn after domain purchase

203 points by ibaikov 5y ago

sp332 5y ago
4 years ago, Archive Team backed up "nearly all" of Vidme (according to Jason Scott). It was uploaded to the Internet Archive here https://archive.org/details/archiveteam_vidme https://archive.org/details/archiveteam_vidme so you can fix your vid.me URLs by pointing them to the Archive. (And you can help keep them there, too https://archive.org/donate https://archive.org/donate But honestly, using the Archive more keeps the bigger donors involved, so don't feel guilty or anything. Just use the Archive!)
- ibaikov 5y ago
  Oh that's clever, I totally forgot about this. Archive is amazing.
  - toomuchtodo 5y ago
    Not all public goods are flashy, but most are necessary.
- swiley 5y ago
  That really is an amazing organization.
  - 1vuio0pswjnm7 5y ago
    There should be more than one archive.org Why not. Is it really impossible I read a significant percentage of HN submissions through archive.org. Saves me DNS lookups. Recent pages look exactly the same to me as their "live" versions, the retrieval time is rarely bad.^1 Its probably the best "CDN" as it has the largest amount and variety of content There should be more than one archive.org (and more than one ArchiveTeam). These projects work and they are standing the test of time. archive.org is older than Google. Much, much older in "internet time". 1. I use a text-only browser though so not sure how tolerable it would through Javascript-enabled graphical browser
- Scoundreller 5y ago
  So uhhhh, anyone want to write the recursive replacement regex that'll do that across an entire filesystem?
  - lallysingh 5y ago
    find | xargs awk?
    - toomuchtodo 5y ago
      Wikipedia has a bot that the Internet Archive collaborated on [1], where rotten links are updated to point to the Internet Archive and new links are queued for retrieval [2]. There should probably be a similar effort for CMS systems like Wordpress and such. The code to do this is semi trivial. [1] https://meta.wikimedia.org/wiki/InternetArchiveBot https://meta.wikimedia.org/wiki/InternetArchiveBot [2] https://en.wikipedia.org/wiki/Wikipedia:Link_rot https://en.wikipedia.org/wiki/Wikipedia:Link_rot
      - sp332 5y ago
        But the links here haven't rotted, in that they will not return a 404 or whatever. They will still load videos, it will just be replaced with porn. So you need more code to detect all vidme links as something to fall back to the Archive for.
        toomuchtodo 5y ago
        In a sense, all of the links for the domain in question have rotted, and must be replaced. To your point, your code could replace wholesale based on the domain.
- danso 5y ago
  The search results counter is 12,385...is that really all (or "nearly all") of what Vid.me had for content? I mean I know it failed at dethroning Youtube, but 12,000+ videos is barely anything.
  - boomboomsubban 5y ago
    That's roughly one hour of new uploads on YouTube as of 2016.
    - mixmastamyk 5y ago
      Like everything, a great majority are junk and/or niche.
  - oxguy3 5y ago
    It looks like each of those 12,385 items is a big 10.4GB archive of thousands of videos.
  - tech234a 5y ago
    That is the number of megawarc items. Each one of these items contains many videos.
- Scoundreller 5y ago
  weird flex, but I needed to get over a threshold to 'earn' a credit card promo for spending enough, and a donation here will do it! (It's too bad the tax deduction isn't eligible in Canada :( )
  - alexjplant 5y ago
    I have the opposite problem... I give money to OpenBSD but can't claim it on my taxes since they're Canadian :-(.
    - darrylb42 5y ago
      Are they a registered non-profit now? I donated when I used OpenBSD but don't think I got a tax receipt, just my name on one of the releases.
      - Scoundreller 5y ago
        Was hoping there was maybe opportunity for corresponding donations that maximizes deductions. Looks like openBSD isn't deductible either for Canadian donoUrs. Theo's registered address has lots of cool wifi links though. I count 4! (one is on the gutter) https://www.google.com/maps/place/812+23+Ave+SE,+Calgary,+AB+T2G+1N4/@51.0329538,-114.0427806,3a,15y,335.4h,101.03t/data=!3m6!1e1!3m4!1scQQgVrRZwyl9ALzXSHrvLg!2e0!7i13312!8i6656!4m5!3m4!1s0x53717009e91678d5:0x551c163042cb0356!8m2!3d51.0331412!4d-114.0428972 https://www.google.com/maps/place/812+23+Ave+SE,+Calgary,+AB...
- Causality1 5y ago
  I wish they'd been doing that when Google Video shut down. Lost a lot of good content I didn't download.
  - tech234a 5y ago
    They did: https://wiki.archiveteam.org/index.php/Google_Video https://wiki.archiveteam.org/index.php/Google_Video
    - Causality1 5y ago
      I think I'm not understanding something. I believe https://archive.org/details/googlevideo2011 https://archive.org/details/googlevideo2011 is supposed to be the videos they downloaded but I'm not getting any results no matter what search term I put in. Is there a searchable archive of Google Video content?
  - sp332 5y ago
    I helped download a few gigs of Google Video at the time, so I know some of it is up there.
    - sp332 5y ago
      Late edit: never mind, that was Yahoo video.
oakwhiz 5y ago
Very amusing but I take issue with the article's claim that "Here’s (yet another) argument against using third-party embeds" - this might be an oversimpified perspective when it's actually a good argument to use subresource integrity (essentially cryptographic pinning of third party embedded content). I am unsure if this extends to every kind of resource that you could have in a web page, (ideally it should) but I could imagine a JS shim being used to cover some edge cases.
- sp332 5y ago
  Subresource integrity would prevent the porn from showing up, but the videos would still be broken. Hosting the videos yourself is the option that would keep things running.
  - deleted 5y ago
    [deleted]
  - oakwhiz 5y ago
    True, and HTML5 video tends to "just work," however I've found that many people have practical issues with hosting their own video. For example, not understanding video conversion, hosting behind bandwidth or request rate limitations, or not having anycast/CDN set up to hold the site together when a page unexpectedly goes viral. There are reasons that hosting videos yourself might not be an effective use of the resources or time available to you, especially based on technical skills, in which case third party hosting with pinning remains a better option.
- jandrese 5y ago
  Video embeds tend to be especially fragile however since they're often implemented by gluing together a relatively large number of third party services. Any one of the services goes down or changes the API and the whole thing breaks. Ask any uMatrix user how much fun it is to get a video to play on some websites and just how much external crap you have to allow before you see the first frame.
  - 5y ago
AkshitGarg 5y ago
Genuinely curious, how does a company manage their domains after they shut down their services to prevent this kind of stuff
- cyberge99 5y ago
  I would think the same way a person would posthumously: let it expire and let natural order take over or delegate ownership via legal/custodial means. Sorry that doesn’t answer your question more than “it depends on the entity”.
- tyingq 5y ago
  You could pre-pay for X years, where X is long enough to ensure you'll be dead when it expires. Edit: Seems like there's a 10 year limit in many places? I wonder if that's broad convention or an actual rule. Okay, apparently an ICANN limit for .com domains: "The expiration date of the domain registration is extended by the number of years, up to a maximum of ten years, as specified by the Registrar's requested Extend operation." https://www.icann.org/en/registry-agreements/com/com-registry-agreement-appendix-7-1-12-2012-en https://www.icann.org/en/registry-agreements/com/com-registr... Though, I can see that navy.us has an expiry in 2053, so it's likely per registry.
  - tqkxzugoaupvwqr 5y ago
    I can at most pay for 10 years in advance. Is this a limit of my registrar?
    - tyingq 5y ago
      On mine, I can pay for up to 10 years, but I think I can just pay twice and get 20. Edit: It seems to vary. Some places cite an ICANN limit of 10 years.
      - rootusrootus 5y ago
        That may vary by registrar. My .com domain is about 2 years out from renewal and the most it will let me add is 8.
TekMol 5y ago
Domains are an area where blockchain technology could help a lot. A domain could cost a fixed amount of X per month. So you could pay 100 years upfront and be sure to not lose it in that timeframe. To move a domain,the registrar and the owner could have to sign the move. So it would not be possible anymore to lose a domain due to the regsitrar making a mistake.
- jazzyjackson 5y ago
  “ethereum name service” is doing this and honestly aside from gas fees it’s not a bad price for permanent real estate (as permanent as the ethereum virtual machine at least)
- mdoms 5y ago
  Can you explain in detail what problem blockchain solves here and why it can't be solved without blockchain?
  - floren 5y ago
    Well, if it's solved via blockchain, there's an opportunity for speculation among early adopters, which I think is the major selling point for most blockchain "solutions"
  - TekMol 5y ago
    The problem that someone else can move your domain. The same problem it solves for finance: That someone else can move your money.
    - crummy 5y ago
      Don't normal domains work the same - you pay a fee and you get the domain for X years? In both situations the domains expire and a porn site can nab them.
      - TekMol 5y ago
        With normal domains, the registrar can move your domain without your approval. So they could do so out of malice or because they get tricked into believing you gave them the go or because they got hacked or got ordered to do so by some governmental institution or or or ...
ignitionmonkey 5y ago
We can't and shouldn't expect people to keep their old domains forever. We need a way for pages to be signed and hyperlinks to enforce authorship. When we link to stuff, we should have a way to say whose stuff we're linking to. It's no different from installing signed software and using trusted repositories. This is one of the reasons I created a proof-of-concept web extension that verifies links and pages using PGP. On a mismatch, it flags the page and offers a web archive link instead. https://webverify.jahed.dev/ https://webverify.jahed.dev/ It was pretty fun to make, but currently due to performance, Web Extensions API doesn't provide the features to do this perfectly. Firefox provides just about enough additional APIs to hack it together.
- alisonkisk 5y ago
  Also, Signed Exchanges for CDNs. https://developers.google.com/web/updates/2018/11/signed-exchanges https://developers.google.com/web/updates/2018/11/signed-exc...
- LinuxBender 5y ago
  Could SRI be used for this? [1] [1] - https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
  - ignitionmonkey 5y ago
    SRI/hashing works for static content. Though it's worth mentioning it's a SUB-resource feature (images, scripts, etc.). It doesn't work for hyperlinks to other pages. Even if it did, it's a different use case. Say I link to an article by Author A that has comments in it (or even a footer, relative timestamp, sidebar, etc.). Hashing won't work as the page is always changing. I want the link to always go to Author A but I don't care if the content changes. That's the sort of use case signed webpages and hyperlinks with enforced authorship covers. It's less about what's on the page and more about who created it.
    - LinuxBender 5y ago
vernie 5y ago
Any discussion beyond "lol damn" is unnecessary.
mindslight 5y ago
There were non-porn videos on the original vid.me? TIL.
nanis 5y ago
I guess I submitted too early :-) https://news.ycombinator.com/item?id=27925605 https://news.ycombinator.com/item?id=27925605
anigbrowl 5y ago
What's the win for the new owner, do they make money from linking to the porn somehow? Sure it could also be just for lulz but there are many equally or more lulzy possibilities whereas porn often seems to be coupled with economic gain.
- dragonwriter 5y ago
  > What's the win for the new owner, do they make money from linking to the porn somehow? They are the porn (the new owner is a porn firm), so, yes. I haven't seen the actual linked content, but I assume its something like free samples with directions telling people where to get more; its a move that gets porn ads placed for free in a lot of places that would never choose to allow porn ads.
  - anigbrowl 5y ago
    Thanks, I didn't find it clear from the article and had no desire to go looking for content.
  - nerdponx 5y ago
    It might also be an accident, if all the embeds are iframes that redirect to the homepage.
dredmorbius 5y ago
The trend toward embeds rather than screenshots or direct copying has long struck me as ill-conceived. At least it's only pr0n. As a vector for malware / spyware injection, this could be even more interesting. Relevant xkcd, of course: https://xkcd.com/1698/ https://xkcd.com/1698/ h/t Elda King @ Mastodon https://weirder.earth/@eldaking/106626603001624730 https://weirder.earth/@eldaking/106626603001624730
jtvjan 5y ago
I'd get it if it was Goatse, but this is just regular porn. If they simply wanted to earn money from ads, serving something more milquetoast would make more sense, because now there's a rush to remove old embeds. Why?!
- vmception 5y ago
  Now everyone know about it and vidme’s ad space is more valuable Genius
- bitwize 5y ago
  > serving something more milquetoast Never gonna give you up...
- jobigoud 5y ago
  They just bought the domain they are not actively serving the embeds URLs.
kazinator 5y ago
> Here’s (yet another) argument against using third-party embeds on your respectable website Well, it's an argument against using embeds without having any way to validate their authenticity. This is analogous to having a software distro (e.g. package manager) which downloads upstream tarballs or git repos without checking any hashes. Is there a solution for this? Say you want to embed a video from some third party sites; what tools are there for ensuring that the embedding will somehow lapse if the video at that URL has been replaced or altered? Ideally, you'd be notified if that happened. While not showing porn is good, but videos not working is bad. You can't be checking an entire site all the time for non-working external content.
- thaumasiotes 5y ago
  https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
one_off_comment 5y ago
The weird thing about this to me is, the company or person who scooped up the domain... in order to get their plan working so quickly, wouldn't they have had to set up a site perfectly beforehand so the embeds would work as desired and then just sat there waiting, hoping, ready to hit the button to scoop up the domain at just the right time, praying nobody beat them to it? Isn't that a lot of work for almost no gain?
- dec0dedab0de 5y ago
  depending on how vidme stored their videos it could just be as simple as returning any request for a video file with whatever they were showing.
- duskwuff 5y ago
  The embeds don't actually "work", per se. When the browser tries to load the embed into an <iframe>, it gets redirected to the home page of the porn site, and ends up displaying the upper left corner of that page in the space where the video embed was supposed to go. It all looks rather more accidental than purposeful.
  - one_off_comment 5y ago
    Ah, good to know. That explains it. I feel like this aspect was lost in reporting this. It was all made to sound much more deliberate.
edoceo 5y ago
One of the services I've sold more than once was to handle the "offlining" of a domain. Basically provide a 307/404/410 service and make sure it works for a long time before the name gets released. Basically to help clean up on the way out.
- amatecha 5y ago
  why 307 (temporary) and not 308 (permanent)? (curious about this as when I used to work on a ton of company websites and migrate from old sites, there'd always be a big process of setting up a ton of 301 (permanent) redirects)
  - kosayoda 5y ago
    As both the post topic and the parent comment topic are about domain changes, wouldn't that basically direct users of the old site on the domain to a totally different domain when they want to access the new site on the same domain?
    - amatecha 5y ago
      It could.. it all depends how the redirects are set up. You can use 301/308 redirect for either new page/path or new domain, or both. It's pretty flexible. If you're interested to learn more, Google has a pretty good "best practices" page at https://developers.google.com/search/docs/advanced/crawling/301-redirects https://developers.google.com/search/docs/advanced/crawling/...
  - edoceo 5y ago
    Sorry, just a typo from the brain. It's a config option - with a few in the 300 series, mostly choosing a permanent option
    - amatecha 5y ago
      Ahh cool, I see! All good, was curious if there was some new special technique maybe I hadn't heard about, haha :)
S-E-P 5y ago
That’s kind of hilarious but gross all at the same time
paulpauper 5y ago
Or 3rd party JS libraries. instead of https://code.jquery.com/ https://code.jquery.com/, your admin 'accidentally' added https://code.jqeury.com/ https://code.jqeury.com/ which embeds a crypto miner
sideproject 5y ago
I use Domainy https://www.domainy.io https://www.domainy.io to monitor interesting domains being expired and to also find interesting domains that are available. twitter.accountant? what about twitter.beauty? Domains are not exactly available when they expire, but this helps me to check if any of them become available.
skibby 5y ago
I can't even imagine the amount of exposure to minors this has caused. But that's nothing new for the porn industry.
alisonkisk 5y ago
Why isn't this considered criminal vandalism and hacking? Intent matters. Owning the domain doesn't give them a right to intentionally interfere with the requested content; they should simply decline to serve the expired URLs.
- jobigoud 5y ago
  Based on another comment it's what they do. The dead URLs are redirected to their main page which gets embedded in place of the original videos. I don't think they should inherit the maintenance cost of the incoming links, as long as they are not maliciously swapping the content.

203 points by ibaikov 5y ago

4 years ago, Archive Team backed up "nearly all" of Vidme (according to Jason Scott). It was uploaded to the Internet Archive here https://archive.org/details/archiveteam_vidme https://archive.org/details/archiveteam_vidme so you can fix your vid.me URLs by pointing them to the Archive. (And you can help keep them there, too https://archive.org/donate https://archive.org/donate But honestly, using the Archive more keeps the bigger donors involved, so don't feel guilty or anything. Just use the Archive!)

ibaikov 5y ago
Oh that's clever, I totally forgot about this. Archive is amazing.
- toomuchtodo 5y ago
  Not all public goods are flashy, but most are necessary.
swiley 5y ago
That really is an amazing organization.
- 1vuio0pswjnm7 5y ago
  There should be more than one archive.org Why not. Is it really impossible I read a significant percentage of HN submissions through archive.org. Saves me DNS lookups. Recent pages look exactly the same to me as their "live" versions, the retrieval time is rarely bad.^1 Its probably the best "CDN" as it has the largest amount and variety of content There should be more than one archive.org (and more than one ArchiveTeam). These projects work and they are standing the test of time. archive.org is older than Google. Much, much older in "internet time". 1. I use a text-only browser though so not sure how tolerable it would through Javascript-enabled graphical browser
Scoundreller 5y ago
So uhhhh, anyone want to write the recursive replacement regex that'll do that across an entire filesystem?
- lallysingh 5y ago
  find | xargs awk?
  - toomuchtodo 5y ago
    Wikipedia has a bot that the Internet Archive collaborated on [1], where rotten links are updated to point to the Internet Archive and new links are queued for retrieval [2]. There should probably be a similar effort for CMS systems like Wordpress and such. The code to do this is semi trivial. [1] https://meta.wikimedia.org/wiki/InternetArchiveBot https://meta.wikimedia.org/wiki/InternetArchiveBot [2] https://en.wikipedia.org/wiki/Wikipedia:Link_rot https://en.wikipedia.org/wiki/Wikipedia:Link_rot
    - sp332 5y ago
      But the links here haven't rotted, in that they will not return a 404 or whatever. They will still load videos, it will just be replaced with porn. So you need more code to detect all vidme links as something to fall back to the Archive for.
      - toomuchtodo 5y ago
        In a sense, all of the links for the domain in question have rotted, and must be replaced. To your point, your code could replace wholesale based on the domain.
danso 5y ago
The search results counter is 12,385...is that really all (or "nearly all") of what Vid.me had for content? I mean I know it failed at dethroning Youtube, but 12,000+ videos is barely anything.
- boomboomsubban 5y ago
  That's roughly one hour of new uploads on YouTube as of 2016.
  - mixmastamyk 5y ago
    Like everything, a great majority are junk and/or niche.
- oxguy3 5y ago
  It looks like each of those 12,385 items is a big 10.4GB archive of thousands of videos.
- tech234a 5y ago
  That is the number of megawarc items. Each one of these items contains many videos.
Scoundreller 5y ago
weird flex, but I needed to get over a threshold to 'earn' a credit card promo for spending enough, and a donation here will do it! (It's too bad the tax deduction isn't eligible in Canada :( )
- alexjplant 5y ago
  I have the opposite problem... I give money to OpenBSD but can't claim it on my taxes since they're Canadian :-(.
  - darrylb42 5y ago
    Are they a registered non-profit now? I donated when I used OpenBSD but don't think I got a tax receipt, just my name on one of the releases.
    - Scoundreller 5y ago
      Was hoping there was maybe opportunity for corresponding donations that maximizes deductions. Looks like openBSD isn't deductible either for Canadian donoUrs. Theo's registered address has lots of cool wifi links though. I count 4! (one is on the gutter) https://www.google.com/maps/place/812+23+Ave+SE,+Calgary,+AB+T2G+1N4/@51.0329538,-114.0427806,3a,15y,335.4h,101.03t/data=!3m6!1e1!3m4!1scQQgVrRZwyl9ALzXSHrvLg!2e0!7i13312!8i6656!4m5!3m4!1s0x53717009e91678d5:0x551c163042cb0356!8m2!3d51.0331412!4d-114.0428972 https://www.google.com/maps/place/812+23+Ave+SE,+Calgary,+AB...
Causality1 5y ago
I wish they'd been doing that when Google Video shut down. Lost a lot of good content I didn't download.
- tech234a 5y ago
  They did: https://wiki.archiveteam.org/index.php/Google_Video https://wiki.archiveteam.org/index.php/Google_Video
  - Causality1 5y ago
    I think I'm not understanding something. I believe https://archive.org/details/googlevideo2011 https://archive.org/details/googlevideo2011 is supposed to be the videos they downloaded but I'm not getting any results no matter what search term I put in. Is there a searchable archive of Google Video content?
- sp332 5y ago
  I helped download a few gigs of Google Video at the time, so I know some of it is up there.
  - sp332 5y ago
    Late edit: never mind, that was Yahoo video.

oakwhiz 5y ago

Very amusing but I take issue with the article's claim that "Here’s (yet another) argument against using third-party embeds" - this might be an oversimpified perspective when it's actually a good argument to use subresource integrity (essentially cryptographic pinning of third party embedded content). I am unsure if this extends to every kind of resource that you could have in a web page, (ideally it should) but I could imagine a JS shim being used to cover some edge cases.

sp332 5y ago
Subresource integrity would prevent the porn from showing up, but the videos would still be broken. Hosting the videos yourself is the option that would keep things running.
- deleted 5y ago
  [deleted]
- oakwhiz 5y ago
  True, and HTML5 video tends to "just work," however I've found that many people have practical issues with hosting their own video. For example, not understanding video conversion, hosting behind bandwidth or request rate limitations, or not having anycast/CDN set up to hold the site together when a page unexpectedly goes viral. There are reasons that hosting videos yourself might not be an effective use of the resources or time available to you, especially based on technical skills, in which case third party hosting with pinning remains a better option.
jandrese 5y ago
Video embeds tend to be especially fragile however since they're often implemented by gluing together a relatively large number of third party services. Any one of the services goes down or changes the API and the whole thing breaks. Ask any uMatrix user how much fun it is to get a video to play on some websites and just how much external crap you have to allow before you see the first frame.
- 5y ago

AkshitGarg 5y ago

Genuinely curious, how does a company manage their domains after they shut down their services to prevent this kind of stuff

cyberge99 5y ago
I would think the same way a person would posthumously: let it expire and let natural order take over or delegate ownership via legal/custodial means. Sorry that doesn’t answer your question more than “it depends on the entity”.
tyingq 5y ago
You could pre-pay for X years, where X is long enough to ensure you'll be dead when it expires. Edit: Seems like there's a 10 year limit in many places? I wonder if that's broad convention or an actual rule. Okay, apparently an ICANN limit for .com domains: "The expiration date of the domain registration is extended by the number of years, up to a maximum of ten years, as specified by the Registrar's requested Extend operation." https://www.icann.org/en/registry-agreements/com/com-registry-agreement-appendix-7-1-12-2012-en https://www.icann.org/en/registry-agreements/com/com-registr... Though, I can see that navy.us has an expiry in 2053, so it's likely per registry.
- tqkxzugoaupvwqr 5y ago
  I can at most pay for 10 years in advance. Is this a limit of my registrar?
  - tyingq 5y ago
    On mine, I can pay for up to 10 years, but I think I can just pay twice and get 20. Edit: It seems to vary. Some places cite an ICANN limit of 10 years.
    - rootusrootus 5y ago
      That may vary by registrar. My .com domain is about 2 years out from renewal and the most it will let me add is 8.

TekMol 5y ago

Domains are an area where blockchain technology could help a lot. A domain could cost a fixed amount of X per month. So you could pay 100 years upfront and be sure to not lose it in that timeframe. To move a domain,the registrar and the owner could have to sign the move. So it would not be possible anymore to lose a domain due to the regsitrar making a mistake.

jazzyjackson 5y ago
“ethereum name service” is doing this and honestly aside from gas fees it’s not a bad price for permanent real estate (as permanent as the ethereum virtual machine at least)
mdoms 5y ago
Can you explain in detail what problem blockchain solves here and why it can't be solved without blockchain?
- floren 5y ago
  Well, if it's solved via blockchain, there's an opportunity for speculation among early adopters, which I think is the major selling point for most blockchain "solutions"
- TekMol 5y ago
  The problem that someone else can move your domain. The same problem it solves for finance: That someone else can move your money.
  - crummy 5y ago
    Don't normal domains work the same - you pay a fee and you get the domain for X years? In both situations the domains expire and a porn site can nab them.
    - TekMol 5y ago
      With normal domains, the registrar can move your domain without your approval. So they could do so out of malice or because they get tricked into believing you gave them the go or because they got hacked or got ordered to do so by some governmental institution or or or ...

ignitionmonkey 5y ago

We can't and shouldn't expect people to keep their old domains forever. We need a way for pages to be signed and hyperlinks to enforce authorship. When we link to stuff, we should have a way to say whose stuff we're linking to. It's no different from installing signed software and using trusted repositories. This is one of the reasons I created a proof-of-concept web extension that verifies links and pages using PGP. On a mismatch, it flags the page and offers a web archive link instead. https://webverify.jahed.dev/ https://webverify.jahed.dev/ It was pretty fun to make, but currently due to performance, Web Extensions API doesn't provide the features to do this perfectly. Firefox provides just about enough additional APIs to hack it together.

alisonkisk 5y ago
Also, Signed Exchanges for CDNs. https://developers.google.com/web/updates/2018/11/signed-exchanges https://developers.google.com/web/updates/2018/11/signed-exc...
LinuxBender 5y ago
Could SRI be used for this? [1] [1] - https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- ignitionmonkey 5y ago
  SRI/hashing works for static content. Though it's worth mentioning it's a SUB-resource feature (images, scripts, etc.). It doesn't work for hyperlinks to other pages. Even if it did, it's a different use case. Say I link to an article by Author A that has comments in it (or even a footer, relative timestamp, sidebar, etc.). Hashing won't work as the page is always changing. I want the link to always go to Author A but I don't care if the content changes. That's the sort of use case signed webpages and hyperlinks with enforced authorship covers. It's less about what's on the page and more about who created it.
  - LinuxBender 5y ago

vernie 5y ago

Any discussion beyond "lol damn" is unnecessary.

mindslight 5y ago

There were non-porn videos on the original vid.me? TIL.

nanis 5y ago

I guess I submitted too early :-) https://news.ycombinator.com/item?id=27925605 https://news.ycombinator.com/item?id=27925605

anigbrowl 5y ago

What's the win for the new owner, do they make money from linking to the porn somehow? Sure it could also be just for lulz but there are many equally or more lulzy possibilities whereas porn often seems to be coupled with economic gain.

dragonwriter 5y ago
> What's the win for the new owner, do they make money from linking to the porn somehow? They are the porn (the new owner is a porn firm), so, yes. I haven't seen the actual linked content, but I assume its something like free samples with directions telling people where to get more; its a move that gets porn ads placed for free in a lot of places that would never choose to allow porn ads.
- anigbrowl 5y ago
  Thanks, I didn't find it clear from the article and had no desire to go looking for content.
- nerdponx 5y ago
  It might also be an accident, if all the embeds are iframes that redirect to the homepage.

dredmorbius 5y ago

The trend toward embeds rather than screenshots or direct copying has long struck me as ill-conceived. At least it's only pr0n. As a vector for malware / spyware injection, this could be even more interesting. Relevant xkcd, of course: https://xkcd.com/1698/ https://xkcd.com/1698/ h/t Elda King @ Mastodon https://weirder.earth/@eldaking/106626603001624730 https://weirder.earth/@eldaking/106626603001624730

jtvjan 5y ago

I'd get it if it was Goatse, but this is just regular porn. If they simply wanted to earn money from ads, serving something more milquetoast would make more sense, because now there's a rush to remove old embeds. Why?!

vmception 5y ago
Now everyone know about it and vidme’s ad space is more valuable Genius
bitwize 5y ago
> serving something more milquetoast Never gonna give you up...
jobigoud 5y ago
They just bought the domain they are not actively serving the embeds URLs.

kazinator 5y ago

> Here’s (yet another) argument against using third-party embeds on your respectable website Well, it's an argument against using embeds without having any way to validate their authenticity. This is analogous to having a software distro (e.g. package manager) which downloads upstream tarballs or git repos without checking any hashes. Is there a solution for this? Say you want to embed a video from some third party sites; what tools are there for ensuring that the embedding will somehow lapse if the video at that URL has been replaced or altered? Ideally, you'd be notified if that happened. While not showing porn is good, but videos not working is bad. You can't be checking an entire site all the time for non-working external content.

thaumasiotes 5y ago
https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

one_off_comment 5y ago

The weird thing about this to me is, the company or person who scooped up the domain... in order to get their plan working so quickly, wouldn't they have had to set up a site perfectly beforehand so the embeds would work as desired and then just sat there waiting, hoping, ready to hit the button to scoop up the domain at just the right time, praying nobody beat them to it? Isn't that a lot of work for almost no gain?

dec0dedab0de 5y ago
depending on how vidme stored their videos it could just be as simple as returning any request for a video file with whatever they were showing.
duskwuff 5y ago
The embeds don't actually "work", per se. When the browser tries to load the embed into an <iframe>, it gets redirected to the home page of the porn site, and ends up displaying the upper left corner of that page in the space where the video embed was supposed to go. It all looks rather more accidental than purposeful.
- one_off_comment 5y ago
  Ah, good to know. That explains it. I feel like this aspect was lost in reporting this. It was all made to sound much more deliberate.

edoceo 5y ago

One of the services I've sold more than once was to handle the "offlining" of a domain. Basically provide a 307/404/410 service and make sure it works for a long time before the name gets released. Basically to help clean up on the way out.

amatecha 5y ago
why 307 (temporary) and not 308 (permanent)? (curious about this as when I used to work on a ton of company websites and migrate from old sites, there'd always be a big process of setting up a ton of 301 (permanent) redirects)
- kosayoda 5y ago
  As both the post topic and the parent comment topic are about domain changes, wouldn't that basically direct users of the old site on the domain to a totally different domain when they want to access the new site on the same domain?
  - amatecha 5y ago
    It could.. it all depends how the redirects are set up. You can use 301/308 redirect for either new page/path or new domain, or both. It's pretty flexible. If you're interested to learn more, Google has a pretty good "best practices" page at https://developers.google.com/search/docs/advanced/crawling/301-redirects https://developers.google.com/search/docs/advanced/crawling/...
- edoceo 5y ago
  Sorry, just a typo from the brain. It's a config option - with a few in the 300 series, mostly choosing a permanent option
  - amatecha 5y ago
    Ahh cool, I see! All good, was curious if there was some new special technique maybe I hadn't heard about, haha :)

S-E-P 5y ago

That’s kind of hilarious but gross all at the same time

paulpauper 5y ago

Or 3rd party JS libraries. instead of https://code.jquery.com/ https://code.jquery.com/, your admin 'accidentally' added https://code.jqeury.com/ https://code.jqeury.com/ which embeds a crypto miner

sideproject 5y ago

I use Domainy https://www.domainy.io https://www.domainy.io to monitor interesting domains being expired and to also find interesting domains that are available. twitter.accountant? what about twitter.beauty? Domains are not exactly available when they expire, but this helps me to check if any of them become available.

skibby 5y ago

I can't even imagine the amount of exposure to minors this has caused. But that's nothing new for the porn industry.

alisonkisk 5y ago

Why isn't this considered criminal vandalism and hacking? Intent matters. Owning the domain doesn't give them a right to intentionally interfere with the requested content; they should simply decline to serve the expired URLs.

jobigoud 5y ago
Based on another comment it's what they do. The dead URLs are redirected to their main page which gets embedded in place of the original videos. I don't think they should inherit the maintenance cost of the incoming links, as long as they are not maliciously swapping the content.