861753 - vine.co links on Twitter and Facebook blocked (mixed content)

Status: RESOLVED WORKSFORME

(Tech Evangelism Graveyard :: English US, defect)

Description

[Justin Dolske [:Dolske]]

I'm getting mixed content warnings (and broken content) from vine.co links on Twitter and Facebook. I've been running with the mixed content pref enabled (before it became default), but only just noticed this. Recent regression?

EG https://twitter.com/frankyan/status/323664806118842368

Hmm:

  <iframe class="card2-player-iframe"
    src="https://vine.co/v/bFrhUFrirYi/card"
    width="375"
    height="375"
    frameborder="0">
  </iframe>

Yeah, even loading https://vine.co/v/bFrhUFrirYi/card directly does the same.

Didn't we add logging for what triggered the mixed blocking? I'm not seeing anything in the web console or error console. :(

Comment 1

[Cork]

Does your installation support mp4? the flash fallback uses http://vjs.zencdn.net/c/video-js.swf

VideoJS.options={
  techOrder:["html5","flash"],
  html5:{},
  flash:{
    swf:"http://vjs.zencdn.net/c/video-js.swf"
  },
  width:"auto",
  height:"auto",
  defaultVolume:0,
  components:{
    posterImage:{},
    textTrackDisplay:{},
    loadingSpinner:{},
    bigPlayButton:{},
    controlBar:{}
  }
}

Comment 2

[Justin Dolske [:Dolske]]

I'm on OS X, so no.

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Note that this is not a problem on Windows 7 as long as MP4 support is enabled. The Twitter embed and the direct link in comment 0 both work fine for me.

(In reply to Cork from comment #1)
> Does your installation support mp4? the flash fallback uses
> http://vjs.zencdn.net/c/video-js.swf

This is exactly what the feature is supposed to block. A MitM can modify the swf to p0wn the hosting page's origin.

I also checked and both of these are identical:

   http://vjs.zencdn.net/c/video-js.swf
  https://vjs.zencdn.net/c/video-js.swf

So, implementing bug 776278 will fix this. Also, more MP4 support on more platforms will fix this on those platforms (bug 799318).

Comment 4

[Tanvi Vyas[:tanvi]]

Should we try to contact twitter and facebook and ask them to update their links to the https version?

Also, is this still a problem?  Visiting https://twitter.com/frankyan/status/323664806118842368 on OS X / Firefox 24, I don't see any issues.

Comment 5

[Cork]

Ya, vine.co has fixed there javascript:

u.Pb="https:"==document.location.protocol?"https://":"http://";

u.options={
  techOrder:["html5","flash"],
  html5:{},
  flash:{
    swf:u.Pb+"vjs.zencdn.net/c/video-js.swf"
  },
  width:"auto",
  height:"auto",
  defaultVolume:0,
  components:{
    posterImage:{},
    textTrackDisplay:{},
    loadingSpinner:{},
    bigPlayButton:{},
    controlBar:{}
  }
}