Live data from Hacker News

YouTube's ban on “hacking techniques” threatens to shut down infosec YouTube

boingboing.net

201–210 of 449 posts

Re: YouTube's ban on “hacking techniques” threatens to shut down infosec YouTube

#201

> Yesterday, Youtube froze Kody Kinzie's longrunning Cyber Weapons Lab channel Did his channel get unbanned? Kody's website links to this active channel with its first video uploaded in Oct 2017: https://www.youtube.com/channel/UCgTNupxATBfWmfehv21ym-g edit: Yep looks like the ban was a mistake ️ > In a subsequent comment, a YouTube spokesperson confirmed to The Verge that Cyber Weapons Lab’s channel was flagged by m…

It is always same story. If a problem concerns someone "well known" who is able to attract attention, than Google, Facebook, etc. are stepping back.

If it were some random "amateurish" hacker channel, it would be banned and nobody would give a crap. The problem is that many valuable things started as some "amateurish" stuff put together by some clever guys in a garage.

Re: YouTube's ban on “hacking techniques” threatens to shut down infosec YouTube

#202

A channel dedicated to creating point-and-click cracking tutorials for complete [expletives] gets banned (go figure.) People cry: waahhh, free speech, think of the [security researchers.] Sorry, but I fail to see how any of this relates to infosec. If it were really about security research then most of the content would be about theoretical topics like classes of vulnerabilities, how PoCs work, how to write basic she…

>People cry: waahhh, free speech, think of the [security researchers.]

What do you think free speech means? Speech you like?

And yes, think of not only groups you can think of like "security researches" (sic) but all those groups you can't think of. These policies are a dragnet. Yeah, they'll MAYBE catch some guys you think shouldn't be on there (and by the way, I'm pretty sure YouTube was banning those guys anyway), but they'll catch a hundreds times more. People who maybe doing peripherally related things, like educational content, or historical content, or satirical and comical content, or a mix of all those and infosec stuff, in all kinds of languages, etc., etc. etc.

But you'll say "They can just appeal", and you know what, if Twitterverse makes a stink about something, maybe it'll work, but 99% of those will never appeal and that content will be lost. Or maybe they'll lose their appeal because what constitutes infringement will fall on the interpretation of some offshored minimum-wage worker (much respect to them), or capricious whims of executives who don't want bad publicity.

>The only people this benefits are the script kiddies.

You sure about that? Really? Really really?

How about them reporters in censor-happy countries, I bet you they are script kiddies too because they aren't programmers.

That's one example, but how about all those other groups you and I can't even think of because we're just not that aware of all the things that happen in the world.

And how do you think you learn about infosec? I bet a non-trivial amount of InfoSec professionals started off as 'script kiddies'. In fact, I bet all the good ones were 'script kiddies' (pretty sure Snowden was a script kiddie).

You know what the difference is between a vulnerability testing tool for use in securing your network vs probing another for nefarious penetration? Nothing.

---

I fully get the motivation of these companies. They want safe content for advertisers, so YouTube will never be a free speech zone.

What I don't get are cheerleaders, usually on the left now, who want these behemoths to keep adding more and more restrictions. Who want a corporate behemoth to act like their mommy and daddy and protected from things they are afraid of and do the same for others too.

Re: YouTube's ban on “hacking techniques” threatens to shut down infosec YouTube

#203

Earlier quoted context omitted.

They have to say it because otherwise people don't subscribe. I know some youtubers who never did it hut had to resort to saying it because their subscriber numbers where stagnating otherwise.

But you know... people CAN just be ok with their subscriber numbers stagnating a bit. Whoring for likes/subscribes is desperate and it cheapens the hell out of your art. It may give you more likes/subscribes but there are other great things that come from artistic creation than the pitifully minimal effort required by the clicking of a button.

It isn't always about art though? If more subscribers equal more views over time which in turns equals more ad revenue, then I can't blame someone who's trying to make a living for doing something that might come across as cheap to some.

Re: YouTube's ban on “hacking techniques” threatens to shut down infosec YouTube

#205

What's next, cracking and reverse-engineering? Debugging? (Anti-authoritarian) programming ? As usual, Stallman tends to be quite prescient: https://www.gnu.org/philosophy/right-to-read.en.html (perhaps more like "right to watch" in this context.)

The big thing RMS misses in that article is all the bio-identification that has been happening the last couple years. Dan is going to get caught because the machine takes a picture of him when he logs in with a password instead of the fingerprint reader, cause you know can't have a PC without a camera pointed at the user..

It's more sinister than that. Dan is going to get caught because his typing frequency, style and mouse movements are unique in the whole world. Moreover, he usually works on a computer with unique hardware that can be fingerprinted by some silly W3C standards already. Camera would be a bonus "just to be sure". We will soon need typing/movements randomizers that would add tiny delays/perturbations to our typing/mouse movement to fool some advanced Deep Learning pattern extractor. Using those would place Dan on some "no loan" blacklist though.

Re: YouTube's ban on “hacking techniques” threatens to shut down infosec YouTube

#206
post #133

Earlier quoted context omitted.

I've noticed older videos as well and often they're really good. Not everything new is better.

But it recommends me videos I remember seeing 5 years ago that just seems unnecessary

The point isn't to make you a more informed and well-rounded person, it's to keep you on YouTube so you see more ads. I bet "old favorites" that might make you feel nostalgic or have rewatch value (it's not a gamble, you already know it's good) makes a significant number of people stay longer.

Re: YouTube's ban on “hacking techniques” threatens to shut down infosec YouTube

#207
post #194
post #145

Earlier quoted context omitted.

This was a shift in viewpoint -- earlier in the life of computers, the hardware was seen as the really valuable part of a computer. So companies would provide the source code because that was simpler (the software was "just a toy"). But then software became the valuable component, and so businesses (as is a recurring theme in capitalism) didn't want to give away something that might be potentially profitable. And so…

I think you may have missed my point. I want businesses to profit off of their software... I just also want them to provide customers with the sources used to produce the software they just paid for. Copyright law can still apply. Just because I have your sources doesn't mean I can go and use them in my own software, or re-implement your patented algorithm. "But how can I be sure that my customer isn't stealing my wo…

You having the sources does not change the incentive of the software’s creator. The unwanted functionality (which the software creator is pressured to include) will instead be put in:

1. Obfuscated code. This is a classic, employed back in the day when raw machine code wasn’t quite as much of a barrier like it is nowadays. Less common now since its importance has lessened, but still ever-present, and could be re-employed instantly.

2. The very design of the software. For instance, the software might require a phone number for every user, and this is baked in at the very fundamental design level, making it impractical to change. Other design choices might encourage you to share your contact lists, for say, backups, and your data is now leaked.

3. The software is merely a collection stubs calling a cloud service. Very common now with so-called "apps" for phones. This design has come to its pinnacle with “web page apps”, where only the front-facing UI portion sits on the user‘s control, and the rest runs remotely.

This is why “shared source” and the like is not enough. The end user must have the practical ability to, reasonably easily change the software, either by themselves or by hiring anyone they like and/or trust to do it for them.

Re: YouTube's ban on “hacking techniques” threatens to shut down infosec YouTube

#208

Earlier quoted context omitted.

I always think he’s mostly right, but a little too uncompromising, but then everything he says comes true. I don’t know how he predicted so far ahead at the time, it’s humbling. As a software author working at startups, am I part of the problem? I don’t understand how to make a good living without locking down the code to some extent, with few exceptions (it’s hard to found red hat)

I think he was a bit off with regards to source code/open source, because while having source code helps in understanding and modification, it's not essential; you could similarly imagine a world in which open-source wasn't a huge movement but instead the right to reverse-engineer (or basically, understand ) software was guaranteed, and it would have as great an effect on freedom; perhaps even more so, because now it…

> while having source code helps in understanding and modification, it's not essential

It technically isn't, much like having an excavator isn't essential to digging up ground for a new mall, when you can technically do this with a shovel too.

I get your point, but right now, I'm sitting in front of a 22-years-old game I spent a great deal of time even trying to get to run. I want to restore it. There's no source leak of it that I know of, it has no clear relation to prior titles and there wasn't any reversing effort I could find either. Half of the formats used by it are obscure, and from causal inspection seem to be dumps of in-memory structures.

Having source code, my main problem would be to build it - but it's essentially a straightforward task of finding and patching or mocking various 1990s-era peculiarities, until the whole thing builds correctly with an reasonably current compiler. The source code would assist me with reversing the data formats too. However, I don't have the source code, just a barely-32bit application with a 16bit installer. The game plays really weird tricks with your screen, so attaching a debugger will be a PITA (unless I figure out how I can run a debugger on a different machine and remotely debug the game on the one computer that it manages to run in half-broken fullscreen mode). Best I can do now is poke it and see what changes.

> It could even be argued that the rise of open-source lead to a decrease in interest and skills of RE.

I think so too - simply because being able to ask decreases interest in and skills of figuring stuff out yourself. Has its good and bad sides.

Re: YouTube's ban on “hacking techniques” threatens to shut down infosec YouTube

#209

The internet promised so much, but is being ruined by corporations and governments. I can't help but feel the ruining is accelerating. I hope the infosec community can come up with some kind of decentralized way to actually share free speech. If anyone is capable, they are. The discovery problem is an illusion. If you build it, they will come.

Well, the internet is still there. It's just that the majority mistook private spaces for public ones.

Well, it is convenient I guess. Your content is being found, the interface is great, someone else is paying for servers, storage and bandwidth. All of that for a little control and advertisements...

And honestly, I want platforms to regulate content. They have millions of users, some of them are underage or even democratically unstable.

It's okay to put a little effort into finding knowledge now and then.

Re: YouTube's ban on “hacking techniques” threatens to shut down infosec YouTube

#210
post #194
post #145

Earlier quoted context omitted.

This was a shift in viewpoint -- earlier in the life of computers, the hardware was seen as the really valuable part of a computer. So companies would provide the source code because that was simpler (the software was "just a toy"). But then software became the valuable component, and so businesses (as is a recurring theme in capitalism) didn't want to give away something that might be potentially profitable. And so…

I think you may have missed my point. I want businesses to profit off of their software... I just also want them to provide customers with the sources used to produce the software they just paid for. Copyright law can still apply. Just because I have your sources doesn't mean I can go and use them in my own software, or re-implement your patented algorithm. "But how can I be sure that my customer isn't stealing my wo…

Kinda how commercial game engines often came with the source code. Not open source, heavily restricted with license, but available for the user (licensee) to look at and make modifications to it required.
Post reply on HN