no youtube

[ygmir]

I tried to post a youtube link, and it's just blank. I also note other ones being the same in the f.u. Jesus thread. and the one link at the bottom takes you to a Russian language page?

help?

[trilobyte]

I'll check into it as soon as I get a chance.

[trilobyte]

Everything's working normally, I see them on my end (I checked that thread as well as others), checking on a couple different systems. It may be worth noting that the more video embeds there are on a page, the longer it can take for the previews to start showing up. Slower machines and connections would have longer delays.

The error message is unusual - that could be something that gets displayed if the page times out on you, or it could be that there was some kind of hiccup with the video embed-a-mabob we use for the site, and it was broken when you experienced the problem, but was fixed by the time I got to take a look.

[Dr. Pyro]

At least you guys can see the videos. My filters here at WFC make it so I can't even see them. Ever.

[FIGJAM]

I'm getting the "View secured content" notice at the bottom of each page.

Have to click on "OK" before the previews show anything.

[trilobyte]

That sounds like a browser preference or security setting, Figgy.

[ygmir]

I found what must have been an upgrade to my anti-virus (bitdefender) which was disallowing youtube.....

[BBadger]

Trilo: The problem is that the site is now using SSL/TLS encryption (https), and on such sites most browsers with default security settings will not allow scripts to execute if they're from non-encrypted sources. In particular, the BBVideo script this board uses is sourced from "http://phpbbex.com/api/bbmedia.js" which is an unsecured site. This situation is affecting all modern browsers on my computer: Firefox, Chrome and Internet Explorer. The user can usually click on some of the warning icons near the address bar, or the prompt in IE, but this has to be done for every page that is loaded. I've even tested this on other systems and get the same result.

Perhaps the site should switch back from using SSL/TLS or host a copy of the script locally?

[FIGJAM]

Here's how.

http://www.tothepc.com/archives/disable ... oolbar-ie/

[BBadger]

The secure content bar is just a symptom of the real problem: visitors to a site shouldn't be required to reduce the default security level of their browsers, or add special exception security settings for a particular site just because that site links to insecure off-site scripts.

Also Internet Explorer already allows mixed passive content, as do most browsers. For example, non-secure images are loaded without problems. The problem comes with non-secured active content, such as off-site scripts, which are considered security hazards; most browsers will deny the scripts with default security settings.

As for the bar itself, that IE secure content bar warning is actually more convenient/obvious for someone to enable the insecure content temporarily than it is for those using Firefox or Chrome; the latter just show a warning icon near the address bar and a broken script.

[trilobyte]

We're not disabling HTTPS. You're welcome to adjust your settings in-browser (if needed), and I'll start investigating options for embedded videos.

[tatonka]

Here's how.

http://www.tothepc.com/archives/disable ... oolbar-ie/

I did the above and the anoying note that pops up is gone , ty

[BBadger]

Yes, that change is convenient, but now you're opening yourself up to a security hazard where malicious sites can intercept data without your knowledge, using insecure scripts. It's like leaving your door unlocked because you can't be bothered to use a key.

Also, you haven't just made a single exception for a site, but instead have disabled protection for your entire browser. This is how people get their information stolen online. That little "lock" icon you see when you make financial transactions? Now the meaning of that is entirely diluted.

So basically, my message is: don't enable all mixed content. It's absolutely stupid. Your browsers are protecting you, and the fault of that mixed content warning is on the website owners. Even then, most browsers are allowing normally benign mixed content to show (e.g. images). Most are only blocking and warning about the potentially malicious content such as scripts being executed.

[FossaFerox]

I imagine they should be able to host a local version of the video script that isn't being passed through the Russian site. In the meantime, users need to stick to enabling it page by page. Annoying? sure. But what some of you are doing is akin to leaving your front door unlocked so that you don't have to hassle with your keys when you get home.

Make no mistake, this (the internet) is a bad neighborhood.

[ygmir]

so, here's my dilema;
I can't open youtubes linked here, due to the russian site? But, can open them direct.
I use Chrome.
But I can't disable the blocking on a "per item" basis, it's either off, or on, for all things. or so it appears.

and, I don't find a link to go to youtube from the non functioning post.........

any thoughts?

[ygmir]

I'm also curious, why, when blocked, there is a link at the bottom that takes me to a russian site, configured sort of similar to eplaya?

[FossaFerox]

That site appears to host the script eplaya uses to embed videos. I'm fairly certain that's what's causing the problem in the first place. The [video] tag is making a call to a third party script.

In the meantime, best practice might be for us frequent users to include the URL to the video below the [video] embed.

[trilobyte]

Man, the speculation and conclusion jumping that people will get up to...

The site's software does not support embedding videos. That functionality has to be added, either through a plugin or through custom BBcodes and scripting. We've had a couple different flavors of that solution in place, but they were strict on how the URL had to be added and users frequently did it wrong. With Bbadger's help, we found the PHPBBEX site's solution, which not only supported a lot more video types besides Youtube and Vimeo, but was a LOT more forgiving with regards to how URL's could be pasted. That solution works via a piece of javascript that runs on the author's site. That way, when Youtube or one of the other video sites changes their URL shortening or link formats or he finds another format to support, he can quickly and easily update his javascript code and everything just works. While we could easily host the code on our site (if the author granted us permission), it would break an important part of the way his solution works.

The solution still works just fine. On browsers that support mixed security settings, it's really simple to click through the alert box that first time, and your choice is remembered for future visits. If your browser doesn't support it, then disabling its security altogether could leave you vulnerable for very bad things. And if you're on a computer running Windows, there's a fuckload of very bad things out there. You can opt to either look around for a browser that supports that, or hold off on watching embedded videos on ePlaya until I find an alternative.

[trilobyte]

Safari (on OSX and iOS) doesn't have a problem with mixed content. Firefox disables it by default, but the 'Toggle Mixed Content' add-on for Firefox (available [ur=https://addons.mozilla.org/en-us/firefo ... -content/l]here[/url]) allows you to easily turn the force field on or off. Once you install the plugin, you'll have a little green box with the letter A in the bottom corner of your browser. Green means the force field is up, click on it to turn the box red and lower the force field. Once you lower it, refresh the page and play the content as you would normally. Once you're done playing it, click on the red box to turn the force field back on so your system is secure.

[ygmir]

dang, wish the was on chrome......

[Eric]

dang, wish the was on chrome......

Yggy - in Chrome (at least on Windows) a little shield pops up on the right hand side of the address window (next to the "star" used to bookmark something). Click that shield, when the little window pops up click "load suspect script", suspect scripts on that page will automatically load, no refresh needed. Super easy.

[BBadger]

There are a lot of things (or lack thereof) in Chrome that make me stick with Firefox despite the latter's quirks. One of them is the massive extensions support that turn this browser into something useful.

That said, forcing people to change their security settings for a site is an unfortunate hack. The bargain that is struck in using a secure site should be that all content on site should be secured -- especially active content. The security really is a feature, not a bug, designed to keep people protected from malicious threats. Adding site-specific exceptions is probably the last solution that isn't outright unacceptable; the scripts really should be hosted locally.

I was (and am) actually pretty horrified to see the posts above instructing people to disable these protections on a browser-wide basis. It's like going back to the early 2000s when less sophisticated browsers were exposing their users to all kinds of hazards without their knowledge. This is also such a security hazard that Chrome doesn't even allow that setting to be changed from within the browser; it must be added as a program option during launch. I also suspect that browsers don't allow site-specific exceptions because there really should be no exceptions to the policy. However, a compromise would be good though, lest people opt to disable the protection altogether, as above.

I think we'll find a solution though.

[trilobyte]

I can appreciate your horrification, Bbadger, but people are still free to make their own informed decisions on what they would like to do.

I think it's been made pretty clear in a number of posts in this thread - if your browser does not support mixed security, disabling all security would be a very bad idea. You could look for a different browser, or an add-on that suits your needs, or just hold off on watching embedded videos on ePlaya until I get something worked out.

[tatonka]

iput mine back , just in case

[FIGJAM]

Me too!

[Patsh]

...back to what?

Mine still doesn't work.

[BBadger]

...back to what?

Mine still doesn't work.

They're talking about removing all security features on the browser to get the videos to work. You probably didn't do that in the first place, which is good.

[ygmir]

dang, wish the was on chrome......

Yggy - in Chrome (at least on Windows) a little shield pops up on the right hand side of the address window (next to the "star" used to bookmark something). Click that shield, when the little window pops up click "load suspect script", suspect scripts on that page will automatically load, no refresh needed. Super easy.

I did see that, and did it....but what it does, is opens that security, across the board. It's not just a "this page, this time" thing, as I see it, anyway. After clicking any link on eplaya opens, until I change settings and disallow.

And, dear Trilo. I'm not impatient or complaining. just saying "this is what's happening to me". I'll deal with the clicking a link, until something changes, it's not a big deal.

[Patsh]

Well, Yggy, I did get to see two cartoons (thanks to the link you put right under them).
And Cat Stevens playing, by turning the green "A" to red, just long enough to get the video started, immediately turned it back to green, and proceeded to watch all of the song.

I do appreciate the link below the posts, I must say!

[Patsh]

Looking back, all three of those had the link below them.
The one I watched with the help of the "A" was Starry Starry Night by Don McLean, a long time favourite, and so appropriately placed by Tatonka.