Feuerfest

Yesterday I learned something which left in quite a bit of shock.

I have noticed that it takes a considerable amount of time (like 30 seconds) for the video to start playing when I watch movies stored on my NAS from my Windows 10 gaming PC. And stupid me was really searching for any error in my network, my NAS, etc. As VLC worked fine for years. Never ever would I have suspected that Microsoft's corporate policy is likely to blame.

Huh? What?

Why VLC suddenly takes 30 seconds to start (and no it is NOT VLC's fault)

VLC isn't one big monolithic .exe file. It's built almost entirely out of plugins for codecs, demuxers, I/O modules all loaded dynamically at runtime. After all one reason for the popularity of VLC is the vast support for any imaginable media file format. Parsing every single plugin binary on every startup would be slow, so VLC keeps an index of them in a file called plugins.dat. Read the index, load what you need, done in milliseconds.

That's the theory. In practice it means plugins.dat is a single point of failure. If something gets between VLC and that file VLC can't read its index. And what could get into the way? Well.. Maybe.. Microsoft Defender flagging it, scanning it, locking it during a background check. That kind of things. No index means VLC falls back to manually scanning the entire plugin directory from scratch. That's your 30 second hang, right there, every time Defender decides to interfere again. Great! Anti-Viruses make us so secure, right?

This also explains the classic pattern some people report: First launch of the day is agonizingly slow, then it's instant for the rest of the session. Once the cache scan clears and VLC gets its index back, it stays fine until Defender flags it again on some later background pass.

Why the story got messy and I suspect an evil actor to be at play

VideoLAN pinned this on a Defender bug introduced in a Windows 11 update, and pushed vlc-cache-gen.exe (regenerates the plugin cache) as the fix. Fair enough. Except their own bug tracker tells a slightly different story. At least one reporter said regenerating plugins.dat did nothing, but dropping in a known-good cache file did fix it, even though a plugins.dat already existed on disk. That's not "missing cache," that's "Defender interfering with an existing, valid cache." Different failure mode, same symptom.

So both camps in the bug tracker were right for their own case. Some machines just need a cache rebuild. Others have Defender actively poisoning a perfectly fine cache. Either way, Defender is the common denominator.

I however find it suspecting that immediately some people in the Internet used this to start defamatory campaigns against OpenSource software. Claiming "A bug like this should never exist" or "Why VLC needs a plugin-cache at all". Which both are pretty stupid arguments in my view. Anti-Virus scanners are known to be one of the main sources for pain in regards to software stability. The whole AV industry is just a big mess. I've seen enough bad AV-Kernel modules on Linux machines. And if you search for "Anti-Virus scanner bricks Windows PCs" plenty of results will show up. So yeah..

What made me realise something other might be going on is this: One person even claimed he now uses the Microsoft Media Player. Wow! That piece of garbage which can't play many commonly used formats? And lacks so many features VLC has?

Bold claim!

Let's just say I notice this pattern regularly towards OpenSource software. If you can't attack the quality of the software itself.. Go create an artificial fault and use that as base argument for your critic.. Yeah..

And it's not that Microsoft hasn't shown this nasty pattern of force-pushing their services and software onto their users. Even against their will! Even when the users explicitly disabled - or even removed - a feature Microsoft just deliberately enables it again at the next opportunity..

The actual fix I use

Regenerating the cache or reinstalling VLC treats the symptom. It WILL come back the next time Defender scans the folder again. If you want it to actually stay fixed, exclude the VLC folder from Defender scanning:

Windows Security → Virus & threat protection → Manage settings → Exclusions → Add an exclusion → Folder: C:\Program Files\VideoLAN\VLC

Or via PowerShell, if you're scripting this:

Add-MpPreference -ExclusionPath "C:\Program Files\VideoLAN\VLC"

Sadly I trust the VLC project more, than Microsoft fixing this bug...

Just a reminder for myself..

I recently updated the LineageOS on my mobile and hence had to revert to the official Stock ROM first. Due to this I, of course, also had to reinstall all apps.

These are the steps I do to configure Termux (Github, F-Droid) on my mobile.

1. After install pkg update followed by pkg upgrade
2. Allow Termux to access the SD-Card storage, so it can read my private SSH-keys: termux-setup-storage
   • Then either provide that path to the keyfile in the .ssh/config like this: /storage/emulated/0/<folder on SD-Card>
   • Or copy the private keyfile to ~/.ssh/, then you are able to revoke the storage permissions again.
3. Install correct SSH package and agent: pkg install ssh-agent openssh
   • Create ~/.ssh/config and test it
4. Test SSH-Connections to various servers
5. Install various tools
   • pkg install dnsutils openssl-tool nmap traceroute

If you ever reviewed a business on Google in Germany you may be familiar with this mail:

In Germany it is pretty easy to get rid of bad, but honest, reviews. The business owner just needs to claim the review is defamatory and Google has to remove it. Shifting the burden of prove towards the reviewer. Often this includes lengthy discussions with lawyers as many business use the services of specialised law-firms.

Which also creates a scenario of financial ruin for people as legal battles can be costly and mistakes are easily made..

As I wrote recently Google now started to display the approximately number of deleted reviews due to defamation. Creating a crucial metric which enables Google Map users to reach an informed decision.

And it didn't take long for someone to scrape that data and take it into account when calculating the "real" score of a business. Of course these numbers are just an approximation, and we have no data on rightfully vs. wrongfully deleted reviews. After all, it is still a nice project: https://trustscope.app/

On my gaming PC Windows complained that C:\ had only 10GB of free space left. Time to free up some space! In WindowsXP times I used a separate Program called GetFolderSize for this, but nowadays with PowerShell I was like: "Hey, I bet I can do this with PowerShell alone."

After a bit of back & forth I came up with the following function:

function Get-FolderSize {
    param([string]$Path = ".")
    Get-ChildItem $Path -Directory | ForEach-Object {
        $size = (Get-ChildItem $_.FullName -Recurse -File -ErrorAction SilentlyContinue |
                 Measure-Object -Property Length -Sum).Sum
        [PSCustomObject]@{
            Folder = $_.Name
            "Size(MB)" = "{0:N2}" -f ($size / 1MB)
            "Size(GB)" = "{0:N2}" -f ($size / 1GB)
        }
    } | Sort-Object { [double]($_."Size(MB)") } -Descending | Format-Table -AutoSize
}

It worked fine. However I always needed to copy & paste it into the current PowerShell window to have the function available. Hence I had a new question: How do I make this function available for my local Windows? How do I add this function to the PowerShell equivalent of a .bashrc?

I myself was surprised I didn't know how to do this. Never needed it before apparently. And at customers PowerShell and/or UserProfiles are always locked down so that I can't do such stuff.

Making a PowerShell function constantly available

Microsoft has some documentation available about the $PROFILE variable: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-7.6

First I tested if I already have a $PROFILE for the current user on the current host. This turned out to be false:

PS C:\Users\USER> Test-Path $PROFILE
False

Hence I simply create the $PROFILE:

PS C:\Users\USER> New-Item -ItemType File -Path $PROFILE -Force


    Verzeichnis: C:\Users\USER\Documents\WindowsPowerShell


Mode        LastWriteTime         Length  Name
----        -------------         ------  ----
-a----      8/8/2026   4:44 PM         0  Microsoft.PowerShell_profile.ps1

Now I can edit my $PROFILE and the Get-FolderSize function:

PS C:\Users\USER> notepad $PROFILE

Then just copy&paste the function in the Microsoft.PowerShell_profile.ps1 file:

After that we need to source the $PROFILE again to have it available. Just like on Linux:

PS C:\Users\USER> . $PROFILE

And it works just fine:

PS C:\Users\USER\AppData> Get-FolderSize .

Folder   Size(MB)  Size(GB)
------   --------  --------
Local    53,609.24 52.35
Roaming  10,956.81 10.70
LocalLow 9,207.82  8.99

Alternatives

PowerShell Gallery

Only later did I learn of the site https://www.powershellgallery.com/, they collect scripts from the community and make them available. There seems to be a good script here, however I didn't use it.

Microsoft SysInternal DiskUsage Utility

There is a du tool from SysInternals available here: https://learn.microsoft.com/en-us/sysinternals/downloads/du. Downloading that and putting the binary in the $PATH should do the trick to. However I did not check if the output matches my desired format.

The start: Knockoff browser extension

A few weeks ago I wrote a post about the Knockoff browser extension which helps consumers to filter out cheap and bogus brands from the Amazon search results. Now I found two websites which help me even more in a) filtering out/recognising bad brands and b) find good brands that still produce quality products which are worth their price.

Discovering: Worse on Purpose.com

It all started when I noticed that the WMF Clip&Close ice cube box is similar to the one produced by EMSA. And both had the same worse reviews as the plastic doesn't seem to be made for storing in freezes as it breaks easily and constantly. Naturally I was curious why WMF sells such crappy products.

And I found the solution on a webpage called Worse on Purpose. In the article Your Cookware Got Worse On Purpose author Keyana Sapp writes in detail about how family-owned companies are bought by international conglomerates who just seek to own the established brand name known for it's high quality products, to sell their cheap & crappy stuff.

The solution to this curiosity was rather boring. Under the headline Six companies, eighty-one brands we learn that both companies are owned by Groupe SEB (Wikipedia) who bought WMF & EMSA in 2016 and is, according to Wikipedia, the world's largest manufacturer of cookware.

Great, that will definitely not have any impace on the quality of WMF products rights? Oh wait.. There have been numerous factories closed since 2025...

The Brand Legder

Worse on Purpose operates The Brand Ledge where you can search for brands and companies names to get a small overview and can now decided for yourself if you still trust that brand. Takes this example for WMF: https://ledger.worseonpurpose.com/brands/wmf

Neat! And very handy!

BuyItForLife.com, the Chef'n Juicer & WMF

I don't really know what to make out of buyitforlife.com. It's a website seemingly vetting products the website owner has used/is using himself.

He states and the frontpage:

Browse 500+ Buy It For Life products I've personally vetted for quality and longevity. Compare where they're made, warranty, category, and price in seconds.
Source: https://buyitforlife.com/

And on the about page:

This list isn't sponsored or biased. It's just me, someone who likes well-built products, going down a rabbit hole to find things that are actually built to last.
Source: https://buyitforlife.com/about

Why I am experiencing such an uneasy feeling when reading that site?

Well, I found the site today. I was search for a manually operated lemon/citrus squeezer/press. The WMF one looked nice at first for 38,99€ but luckily the  Chef'n PalmZester (22,79€) was displayed right next to it.. And.. Well look for yourself:

First the Chef'n model in yellow, than the WMF one in black. They are exactly the same model, just different colours. And apparently black is 16€ more expensive.. Yeah, are you kidding me!?

Amazon reviews on both products state, that it breaks after just 1 year of regular usage. As apparently the plastic can't deal with the stress and breaks at some point. Wow.

What is even more interesting: Chef'n is owned by Lifetime Brands Inc.

And that is a totally different company which as nothing to do with Group SEB who owns WMF. This proves, again, that the brand WMF now stands for nothing. Just a shell used to sell cheap products for a higher price.

Good job capitalism!

BuyItForLife however has this product listed on it's site. Among many other products from companies which Worse on Purpose has on it's Watchlist or where people on Reddit say for years that the products became shittier over the time. I think this is my problem with that site. BuyItForLife is just a single person without any special knowledge. Just recommending products he finds useful. That's fair. Nothing against that, but it isn't as objective as it claims to be. It's just a single persons opinion - marketed as something more...

Nowhere on the site can I read a detailed review about a product. All links point directly to Amazon. No "This is why I recommend that item", nothing. For me, personally, this simply doesn't add up. So no, I'm not going to recommend that site.

In TinyMCE 6.8.1 (the WYSIWYG editor used by Bludit) iframe sandboxing was introduced. This automatically adds the sandbox="" parameter to all inserted <iframe>-tags. This blocks all embedded videos from playing, even when the CSP-Headers are correct.

As I just wanted to write a short blogpost about a YouTube video which discusses why we Germans are able to eat raw pork ("Mett") and suddenly the video wasn't displayed in the editor-view. Browser console showed no problems with CSP-Headers and so I was left to searching..

YouTube gave me the following <iframe> block for embedding the video:

<iframe width="560" height="315"
 src="https://www.youtube-nocookie.com/embed/azdV7EzP0v4?si=sKj7zfe0OkVNxjsi" title="YouTube video player"
 frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share"
 referrerpolicy="strict-origin-when-cross-origin"
 allowfullscreen>
</iframe>

However, after copy&pasting that into the TinyMCE in Bludit and saving the article, it changed to:

<iframe width="560" height="315"
 src="https://www.youtube-nocookie.com/embed/azdV7EzP0v4?si=sKj7zfe0OkVNxjsi" title="YouTube video player"
 frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share"
 referrerpolicy="strict-origin-when-cross-origin"
 allowfullscreen="allowfullscreen"
 sandbox="">
</iframe>

And the added sandbox-parameter triggers the following error in the browser console:

GET https://www.youtube-nocookie.com/img/meh7.png NS_BINDING_ABORTED
A resource is blocked by OpaqueResponseBlocking, please check browser console for details.

Of to the search engine I went and luckily the TineMCE folks wrote so in their release notes:

Note: sandbox_iframes: is set to false by default, which is the existing behavior. This is because enabling sandbox_iframes may break existing media embeds such as YouTube, Vimeo, and Codepen, as actions such as scripting and same-origin access are prevented.
Source: https://www.tiny.cloud/docs/tinymce/6/6.8.1-release-notes/#new-sandbox_iframes-option-that-controls-whether-iframe-elements-will-be-added-a-sandbox-attribute-to-mitigate-malicious-intent

Which is why I was able to find it so quickly.

The fix

I fixed it, by adding the YouTube domains to the iframe-exclusion tag inside the File bludit-folder/bl-plugins/tinymce/plugins.php.

1. Add the sandbox_iframes: true, line
2. The exclusions are defined for the three most used YouTube-domains: youtube.com, youtube-nocookie.com, youtu.be

        tinymce.init({
                selector: "#jseditor",
                auto_focus: "jseditor",
[...]
                link_default_target: '_blank',
                sandbox_iframes: true,
                sandbox_iframes_exclusions: [
                        'youtube.com',
                        'youtube-nocookie.com',
                        'youtu.be'
                ]
        });

Now your TinyMCE behaves like before and embedding videos works again.