diaspora/diaspora — Issue #2193: Issue with embedded content
Author: KBKarma
Created: 2011-10-16 15:07:13+00:00
State: open

I've found an issue with embedded video when using Opera 11.51, build 1087, for Windows 7 32 bit, and Internet Explorer 9.0.8112.16421, presumably for same (IE's About box doesn't specify; the OS is 64-bit, I believe, so it might be that; however, I don't think it matters in this case.). The issue was found on diasp.org, but the host said that it appeared to be a bug in the diaspora codebase itself.

First of all, Opera. When I go to the Stream, the qik video you posted is still on the first page. As a result, I get bombarded with messages from Opera, titled "Security Warning". The first three messages, which pop up at once, one on top of the other, read as follows:

"Information from this secure page will be submitted to a page that is not secure on engine.qik.com.

Submitting sensitive information is strongly discouraged."

Below the message is two boxes, Submit or Cancel. If I click Submit or Cancel on one, the next one pops up, but with both boxes greyed out, requiring me to switch tabs back and forth (by holding the RMB and scrolling the mousewheel forward then back, I do that very quickly) before the boxes ungrey.

When they've all gone, I get nothing until I scroll to the video. Then, I get two more security warnings, again one on top of the other, and both identical to the first, except, in the first case, the "page that is not secure" is on 2819.v.fwmrm.net, while in the second case, it's receive.inplay.tubemogul.com.

Attempting to view the stream in IE gives me no issues, until I scroll down the page to the video. At that point, IE brings up a box at the bottom saying "Only secured content is displayed", alongside a link labelled "What's the risk?" and a button labelled "Show all content." The qik video appears, but doesn't play, but the YouTube video and the Vimeo embeds further down don't appear until I click the button. Then they appear, but the qik video still doesn't play.

In addition, after consulting IE's helpbox thingy that appears after clicking "What's the risk?", I noticed that, while diasp.org was using https, the lock icon indicating a secure site did not appear. Hitting Refresh caused it to appear briefly, but, once the site loaded, it vanished. The address bar was white, which, it said, meant that the connection was encrypted. However, checking Opera's report, it reported that, while the site had no records of security issues, the connection was insecure, stating, in the details, that "The server attempted to apply security measures, but failed."

I think the problem is that the video embedding is insecure, which is playing merry hell with the https connection each browser is using.