Question

I am developing an application that streams live video from ustream’s watershed. (watershed.ustream.tv)

The embedded player works until I put it behind an ssl. Chrome shows the ssl as broken… but doesn’t throw an error. IE8 doesn’t show anything wrong, but firefox throws actionscript errors:

Error #2044: Unhandled securityError:. text=Error #2048: Security sandbox violation: http://cdn1.ustream.tv/swf/4/viewer.rsl.567.swf? cannot load data from https://sb.scorecardresearch.com/p?assorted-querystring-parameters-removed-for-SO-post
    at tv.ustream.viewer.logic.media::Recorded/comScoreBeacon()
    at tv.ustream.viewer.logic.media::Recorded/createConviva()
    at tv.ustream.viewer.logic.media::Channel/connect()
    at tv.ustream.viewer.logic.media::Channel/parseGwResponse()
    at tv.ustream.viewer.logic.media::Recorded/onGwResult()

The embed code that I’m using came from ustream’s watershed… I only modified the with and height:

<object classid="clsid:000000000000000000000000" width="685" height="476" id="000000">
  <param name="flashvars" value="autoplay=false&brand=embed&cid=000000%2FXXXXchannelinfoXXXX&locale=en_US"/>
  <param name="allowfullscreen" value="true"/>
  <param name="allowscriptaccess" value="always"/>
  <param name="movie" value="http://www.ustream.tv/flash/live/0000/XXXXchannelinfoXXXX"/>
  <embed 
    flashvars="autoplay=false&brand=embed&cid=000%2FXXXXchannelinfoXXXX&locale=en_US" 
    width="685" 
    height="476" 
    allowfullscreen="true" 
    allowscriptaccess="always" 
    id="0000000000" 
    name="0000000000" 
    src="http://www.ustream.tv/flash/live/000/XXXXchannelinfoXXXX" type="application/x-shockwave-flash"/>
</object>

So I need to figure out how to embed this behind an ssl without it throwing actionscript errors… any ideas?

Answer 1

The short answer is; You can’t.

After many days of of monkeying around with their player, looking through their docs, posting in forums, researching actionscript, and downloading their sample fla files and tinkering with them, watershed on ustream will always be vulnerable when it is served from behind an ssl.

For more information, see this post: When a page delivers secure and non-secure items over https, are the secure items compromised?