They posted the link, and it kept working
A paid video service found its films on a forum. Not copies — its own links, pasted months earlier, still playing, some of them indexed by search engines.
The team shipped expiring links that week and the leak carried on. The expiring link had only ever been a suggestion: the file's real address in the object store was still public, and anyone who had loaded a video once could read that address out of the player and share it instead.
- R1A link to a video must stop working after a short window, and it must be impossible to construct a working one without asking the service first. Neither guessing an address nor editing one you were legitimately given may produce something that plays.
- R2The store must refuse any request that did not come through the edge, and must decide that from something the caller proves rather than from where it appears to be coming from. Anything not carrying that proof is refused, including callers nobody has thought about.
- R3Uploads are tens of megabytes and arrive from creators' devices, so they must not pass through the application at all. What a creator is given must let them add a new object and must not let them replace or remove one that already exists.
- R4The files are tens of megabytes, identical for every viewer, and written once. Whatever holds them has to be built for that shape rather than charging for it by the row.
Outside every boundary: Creator app (uploads films), Viewer (paid for it), Edge network (serves the bytes), Video API (knows who paid), an empty slot for the mints what the viewer is given, tier 1, an empty slot for the what the store will answer, tier 2, an empty slot for the tens of megabytes, written once, tier 3, an empty slot for the where creators put them directly, tier 3 Connections: Viewer calls Video API Video API calls mints what the viewer is given — only if they paid Viewer calls Edge network Edge network calls what the store will answer what the store will answer calls tens of megabytes, written once Creator app calls mints what the viewer is given Creator app calls where creators put them directly — never via the app where creators put them directly publishes to tens of megabytes, written once Viewer must NOT reach tens of megabytes, written once