2021-03-25
My Account at Open.Tube Peertube Instance Compromized 2
The current state of my open.tube video pages:
---
There is the network trace pertaining to these minutes.
But I also want to publish duplicates where you see the "Sorry This video does not exist."
By the way, to be truthful, in all those cases where you see that Javascript-made inscription on the video canvas (from video-embed.5d290c40a499dd11e6eb.bundle.js that I can extract from the trace and show here, and which is from Peertube client code), currently, the video in question only can't be fetched, it may very well still exist.
Actually, the video very probably does exist, in those cases.
Check it up. In the last 30 seconds, the screencast shows the page No 1 of "vodomjeri" section/directory.
Notice the top video of the page. "2. veljače 2020." g. translates "Feb 2nd 2020". That subsection video.
But at 5:33, 10 seconds to end we are at:
the page No 2 of "vodomjeri" section
that exact video is right-click opened (see its link in the status bar in bottom) and hijack-redirected just like all the videos from:
https://www.croatiafidelis.hr/index.php
as you can see in the first minutes of the screencast.
And it's always because this line:
<script>top.location.href="https://open.tube/videos/watch/d01e6156-81be-428e-b195-185d898908ac";</script>has been somehow injected.
If you have read carefully the No. 1 page, along with the links, then you know that's the same line that I reported to Peertube masters.
I just don't think this will be too hard to fix, if the admin is reached and looks into this.
The network trace shows some itchy things, but I first need to post duplicates for some of the pages.
I am not going to delete any links to open.tube on any of my video pages. Just will try and offer duplicates so the content is available in alternate way, hopefully only temporary.
Can all of this reach to https://selectel.ru/, since the open.tube admin has been, as kinetix said [A]bsent [W]ith[O]ut [L]eave?
---
The above WEBM is listed in: ls-1pg1
and verify to these SHA256: ls-1pg1.sum
signed: ls-1pg1.sum.asc
with my public PGP-key).