STATUS: what is not built yet (signed-out uploads, scanning, app tokens); Video uploads, playlists, Pics, previews and public links shipped; openvibe.pics public since 10-15 (#104)

OP OpenVibers committed 23 days ago · 1b708aa8bf · 2 files, +6 −7

Changes

ddiff --git a/README.md b/README.md
iindex 0c9e309..00885c5 100644
---- a/README.md
++++ b/README.md
@@@ -513,8 +513,8 @@ Reporting a vulnerability: [SECURITY.md](SECURITY.md).
  - The form reader streams files to disk. A text field over 64 KB, a second file, or a body cut off before its last
    boundary is refused.
  - Session tokens are httpOnly cookies. Secrets live only in the env file, and no secret or request body is logged.
--- Next, before Pics or Video take uploads: scanning (hash lists, malware), a DMCA agent, and abuse intake shared
--  with OpenVibe.Media's holds.
++- Next, before Pics or Download take signed-out uploads: scanning (hash lists, malware), a DMCA agent, and abuse intake
++  shared with OpenVibe.Media's holds. Signed-in uploads are open on all three sites.
  
  ---
  
ddiff --git a/STATUS.json b/STATUS.json
iindex 1cd75c8..16cfbd0 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -27,10 +27,9 @@
      "Per-caller and per-address limits; readiness (database required); metrics on loopback"
    ],
    "notYet": [
--    "Uploads on openvibe.pics (images, albums, embeds): parked until scanning (hash lists, malware) and abuse intake shared with Media holds exist",
--    "OpenVibe.Video uploads and public playlists of a channel",
--    "Public (signed-out) share links: deliberately not offered while there is no scanning",
--    "Previews and thumbnails of files"
++    "Signed-out uploads on openvibe.pics (MEDIAHUB_PICS_ANONYMOUS) and openvibe.download (MEDIAHUB_DOWNLOAD_ANONYMOUS): built and off until the owner registers the DMCA designated agent and the CSAM hash-matching account (plan T10)",
++    "Scanning of uploads (hash lists, malware) and abuse intake shared with OpenVibe.Media's holds",
++    "App, agent and service tokens on the drive, Pics and video upload routes: only the two playlist capabilities are registered; every other /api/v1 route needs a signed-in person"
    ],
    "capabilitiesRegistered": true,
    "serviceManifestRegistered": true,
@@@ -46,6 +45,6 @@
    "contracts": "openvibe-contracts v0.209.0",
    "sdk": "openvibe-sdk v0.60.0",
    "shared": "openvibe-shared v4.7.0",
--  "deployment": "openvibe-ovh: unit openvibe-media-hub.service on 127.0.0.1:4990 (git checkout /opt/openvibe.download, env /etc/openvibe/media-hub.env, database ov_media_hub), deployed with `sudo ovhost deploy media-hub`; public at https://openvibe.download since 2026-10-08 and https://openvibe.video since 2026-10-12.",
++  "deployment": "openvibe-ovh: unit openvibe-media-hub.service on 127.0.0.1:4990 (git checkout /opt/openvibe.download, env /etc/openvibe/media-hub.env, database ov_media_hub), deployed with `sudo ovhost deploy media-hub`; public at https://openvibe.download since 2026-10-08, https://openvibe.video since 2026-10-12 and https://openvibe.pics since 2026-10-15.",
    "updated": "2026-10-21"
  }

diff --git a/README.md b/README.md

index 0c9e309..00885c5 100644

--- a/README.md

+++ b/README.md

@@ -513,8 +513,8 @@ Reporting a vulnerability: [SECURITY.md](SECURITY.md).

- The form reader streams files to disk. A text field over 64 KB, a second file, or a body cut off before its last

boundary is refused.

- Session tokens are httpOnly cookies. Secrets live only in the env file, and no secret or request body is logged.

-- Next, before Pics or Video take uploads: scanning (hash lists, malware), a DMCA agent, and abuse intake shared

- with OpenVibe.Media's holds.

+- Next, before Pics or Download take signed-out uploads: scanning (hash lists, malware), a DMCA agent, and abuse intake

+ shared with OpenVibe.Media's holds. Signed-in uploads are open on all three sites.

---

diff --git a/STATUS.json b/STATUS.json

index 1cd75c8..16cfbd0 100644

--- a/STATUS.json

+++ b/STATUS.json

@@ -27,10 +27,9 @@

"Per-caller and per-address limits; readiness (database required); metrics on loopback"

"notYet": [

- "Uploads on openvibe.pics (images, albums, embeds): parked until scanning (hash lists, malware) and abuse intake shared with Media holds exist",

- "OpenVibe.Video uploads and public playlists of a channel",

- "Public (signed-out) share links: deliberately not offered while there is no scanning",

- "Previews and thumbnails of files"

+ "Signed-out uploads on openvibe.pics (MEDIAHUB_PICS_ANONYMOUS) and openvibe.download (MEDIAHUB_DOWNLOAD_ANONYMOUS): built and off until the owner registers the DMCA designated agent and the CSAM hash-matching account (plan T10)",

+ "Scanning of uploads (hash lists, malware) and abuse intake shared with OpenVibe.Media's holds",

+ "App, agent and service tokens on the drive, Pics and video upload routes: only the two playlist capabilities are registered; every other /api/v1 route needs a signed-in person"

"capabilitiesRegistered": true,

"serviceManifestRegistered": true,

@@ -46,6 +45,6 @@

"contracts": "openvibe-contracts v0.209.0",

"sdk": "openvibe-sdk v0.60.0",

"shared": "openvibe-shared v4.7.0",

- "deployment": "openvibe-ovh: unit openvibe-media-hub.service on 127.0.0.1:4990 (git checkout /opt/openvibe.download, env /etc/openvibe/media-hub.env, database ov_media_hub), deployed with `sudo ovhost deploy media-hub`; public at https://openvibe.download since 2026-10-08 and https://openvibe.video since 2026-10-12.",

+ "deployment": "openvibe-ovh: unit openvibe-media-hub.service on 127.0.0.1:4990 (git checkout /opt/openvibe.download, env /etc/openvibe/media-hub.env, database ov_media_hub), deployed with `sudo ovhost deploy media-hub`; public at https://openvibe.download since 2026-10-08, https://openvibe.video since 2026-10-12 and https://openvibe.pics since 2026-10-15.",

"updated": "2026-10-21"

}