Plugin requires everyone viewing a video to connect to google servers at gstatic.com
Our peertube instance received an email from a user reporting that when they viewed a video on our site their browser was pulling sources from the gstatic.com servers run by google. Since one of the primary reasons we're running a peertube instance is allow people to get away from big corporate surveillance tech companies like google, this is a problem for us.
We confirmed the connections to gstatic.com and traced their origin to this plugin, specifically this line:
script.src = 'https://www.gstatic.com/cv/js/sender/v1/cast_sender.js?loadCastFramework=1'
We understand that the javascript file loaded here is an external dependency required by one of the primary dependencies of this plugin, videojs-chromecast. As they explain in their readme:
Note that regardless of whether you are using this plugin via the pre-built JS or as a
module, the Chromecast framework will need to be included after the plugin. For example:
<script src="https://unpkg.com/video.js@6.1.0/dist/video.js"></script>
<script src="./dist/silvermine-videojs-chromecast.min.js"></script>
<script type="text/javascript" src="https://www.gstatic.com/cv/js/sender/v1/cast_sender.js?loadCastFramework=1"></script>
https://github.com/silvermine/videojs-chromecast/blob/master/README.md?plain=1#L25-L32
One way this could be fixed is to vendor (include local copies) in your plugin of the three files that are currently loaded from gstatic.com when viewing a video on a peertube instance running your plugin:
- gstatic.com/cv/js/sender/v1/cast_sender.js?loadCastFramework=1
- gstatic.com/cast/sdk/libs/sender/1.0/cast_framework.js
- gstatic.com/eureka/clank/108/cast_sender.js
Since only the first of these files is loaded directly in your code, the tricky part of this would be making the necessary patch(es) to your vendored version of this file (and possibly a second one) so that the other two files are also loaded from the path of your local version rather than remotely from gstatic.com.
This is only to remove gstatic dependencies for those viewing a video in their browser and not using chromecast. We assume anyone actively deciding to use chromecast is okay with sharing an IP address with google. However, since using your plugin to do a chromecast is probably going to pull in additional gstatic dependencies, if there are frequent updates to these files, and any of these updates break backwards compatibility with older versions of the files you're vendoring, then it is possible that the vendoring could result in the chromecasting functionality of the plugin breaking at some point. Once the problem is identified, this could be fixed by updating your vendored dependencies to match the upstream versions, and then manually reapplying the patches. It could be a source of instability and hassle though, so it is understandable if this isn't feasible for you to take on.
Unfortunately this isn't enough of a priority for the team running our peertube instance to be able to work on a merge request to implement it. Instead, we will be uninstalling the plugin for now, though we're open to reinstalling it in the future if this is resolved. Perhaps you can find a way to do it that will be simpler than the proposal we have outlined above! Thanks for your work on this plugin.