So this brings up a lot of thoughts that I've been meaning to run through but haven't!

1. I think that makes a lot of sense, but if we're still looking to use redditmedia for security purposes then either way we're going to need to hit that domain. Sounds like you're considering not doing that though, which leads me also to the next thought!

2. The way embeds happen right now are kind of wild. ;) For example for a youtube video, we load:

> redditmedia's mediaembed iframe, which renders:
>> embedly's protocol-agnostic CDN iframe, which renders:
>>> youtube's embeddable iframe, which renders:
>>>> youtube's embed tag for the video

Plus, throw in a bonus iframe that embedly appears to use for cross-domain comms. That's a lot of frames and synchronous requests, especially if it's all loading on demand and not through an action like the expando.

If we can trust embedly's CDN to be secure then I think we could remove the redditmedia iframe from the equation, and that would certainly be a bit simpler, and would also foist the masses over to embedly's CDN rather than ours on an update.

Thoughts?