Windows 8 Developer Preview was made available last week and it came with Internet Explorer 10. Internet Explorer 10 can be started within the Metro UI and also in the desktop mode.

However, when started in the Metro UI, Adobe Flash plugin is unavailable and hence you cannot play YouTube videos. There is a workaround for this as Internet Explorer supports the next generation HTML5 capabilities.

YouTube now offers an HTML5 trial on their website. All you need to do is to activate the HTML5 trial using your YouTube account. To activate HTML5 trial, go to www.youtube.com/html5 .

Once you opt-in for HTML5 on YouTube, you can start watching YouTube videos on IE10 in Metro mode.

In this post, I show you how to block users from playing YouTube videos on your network. I also show you how to block Flash content embedded on web pages (although in today’s times blocking all Flash content may not be such a good idea )

Yes you could always block the URL youtube.com but this may not be effective as YouTube videos can be embedded in other websites and there are plenty of sites *like* YouTube out there. A more effective approach would be to block by MIME type, thanks to the enhanced content filtering capabilities built into TMG.

Before I get started, two important notes:

• I mention YouTube because it is everyone’s favorite, but the steps below will work for Vimeo, and any other video sharing sites that rely on Adobe Flash technology.
• The steps below can be used to block YouTube and flash content on ISA Server 2004/2006 too.

Blocking YouTube videos using TMG

1. On the TMG Console, right-click Firewall Policy, choose New Access Rule and create a new “Deny” rule named “Block Youtube” as follows:

Deny

Applies to: All Outbound traffic

From: Internal

To: External

All Users

Click Finish to close the wizard.

2. Do not apply the changes yet! Right click on the new rule you just created and choose Properties.

3. Open the Content Types tab. Click New.

4. Create a new Content Type Set as follows:

Name: YouTube

Available types: (type each of the below and click the Add button)

• video/mp4
• video/x-flv
• video/x-ms-asf

5. Click OK. Ensure the check box next to your new content type set is enabled:

6. Click OK and apply your changes. Wait for the config synchronization to complete.

Test your changes by trying to play some videos on YouTube or other video sharing websites.

Blocking Adobe Flash Player content using TMG

1. Follow steps 1 to 3 above.

2. While creating a new Content Type set, use the following parameters:

Name: Flash

In the available types box, type:

application/x-shockwave-flash

3. Proceed with step 5 above.

Blocking additional MIME types

If you need to block something else, it is easy to find what content type to block. Simply monitor the Logging (Logs & Reports > Logging) in the TMG console. Once you encounter the log entry that allowed the content you want to block, expand the “Additional Information” and you will find the MIME type that you need to block.

Etisalat seems to have fixed the YouTube caching issue that resulted in a major security breach which allowed users to see other user’s favorites, videoes, profiles and messages.

ITP reports that Google has issued a public statement as follows:

We have had reports of this problem in the UAE and believe it was due to caching being done by a local ISP. We take our users’ security very seriously and have made necessary changes to resolve this issue. It should now be fixed, but if users see any more instances, we’d like for them to contact the YouTube support team at http://www.google.com/support/youtube.

It is interesting to note that Etisalat is still silent on this issue.

ITP today reported the YouTube security issue that this blogger wrote about on 19th April 2008. That’s 5 days after I discovered it! [That's another reason why you should subscribe to this blog.]

ITP has confirmed my initial doubts over the cause of the issue – incorrect web caching by the ISP – Etisalat, in this case. Even thought I had written to YouTube regarding the issue, they have not responded to me till this date – neither have they responded to ITP. Etisalat had even gone to the extent of making my blog mysteriously unavailable in the UAE, the day after I posted about the problem.

Read the ITP article here.

Hello world. The time is 12:31 AM in Abu Dhabi, United Arab Emirates, and I have logged in to YouTube to upload a short video. And guess what? I am automatically logged in as another Youtube user that I dont know anything about!!

I kept navigating on various pages in YouTube, and I found that I kept getting logged on as various other users! New vulnerability in Youtube/Google? I guess this will be published in a dozen other blogs by tomorrow and then maybe we can wait and see what Youtube/Google says.
Here are some screenshots. I’m cropping some of the images for ethical reasons

No, I am not a hacker – neither white, nor grey, nor black hat. It just happened. I logged in with my username and password and the next thing I know I get redirected with a new identity. I keep clicking on other links, I get further new identities. I tried to logout and back in – the same story ensues.

This isn’t the first time with Google. The exact same problem was reported by GMail users in Kuwait a few months ago. Users were able to see other users’ inboxes and email. This was caused by a caching issue at a Kuwait ISP and in all probability, what I see with Youtube *might be* the same issue. Well, in my opinion, Google should write code that doesn’t allow the ISP web proxy cache to save somebody’s session and give it to someone else!

Updates:

19 Apr, 10:30 PM This problem seems to affect only users inside the United Arab Emirates. Most likely that the problem is caused by Etisalat, our ISP.
19 Apr, 9:30 PM My blog gets blocked in the UAE
20 Apr, 8:00 AM And we’re back online
23 Apr, 5:00 PM ITP reports the issue
27 Apr, 6.45 PM YouTube security issue in UAE fixed

USEFUL INFORMATION
Getting domain registration on cheap web hosting is no big deal. Getting it on a cheap but quality web hosting is something. At present we have 2 such names, dotster that is comparatively older, and aplus hosting.