16

This job listing has an obnoxious video (with sound obviously) that autoplays as soon as the page loads. Not surprising when you see who their parent company is, but why is this allowed here ?

Screenshot of the disaster :

screenshot

The video is included in an iframe, why is this even possible ? Also the fact that the iframe is completely seamless (as you see above) makes abuse possible, like phishing (I'm not sure if creating some fake documents and obtaining a credit card anonymously is worth the hassle for some SE credentials, but it's definitely possible)...

  • I am not sure but adblock does the trick? – Kyslik Mar 31 '15 at 6:38
13

This is actually a video that the company has in the gallery of their company page. We control the iframe and it is limited to three video providers; YouTube, Vimeo and DailyMotion so the possibility of abuse is low to non-existent.

Our embed URL mistakenly had the autoplay option set which meant the video autoplays when you browse to the company page (or any job listings). Oops!

I've just pushed a fix to prod.

  • I think he means it's possible to steal cookies, not related to video, in the "possible abuse" statement. Anyhow, changed to bug so it can be properly "fixed". :) – Shadow The Curly Braced Wizard Mar 28 '15 at 17:19
  • @ShadowWizard actually no, I thought it was possible to make the iframe link to an arbitrary page and not just to whitelisted video sites. – user230564 Mar 28 '15 at 17:51
  • @AndréDaniel oh, so guess that is now settled as well? :) – Shadow The Curly Braced Wizard Mar 28 '15 at 18:44
  • @ShadowWizard yeah, cf the status-completed tag. – user230564 Mar 28 '15 at 19:38
  • Off topic, but curious to know, have you switched the job search over to Elastic search already? – Shadow The Curly Braced Wizard Mar 30 '15 at 12:32
  • 1
    @ShadowWizard We're running a split test at the moment to make sure there are no regressions in the click-through and application funnels. So soon, hopefully :) – Dean Ward Mar 30 '15 at 14:03

You must log in to answer this question.