EDIT: never mind Should probably be (2019), as the bug has been fixed since (as noted at the bottom of TFA).
AFAICS the article was first posted 18 January 2021, so (2019) would be incorrect.
The embedded YouTube player told me what you were watching
11–20 of 112 posts
Re: The embedded YouTube player told me what you were watching
#12This is a bad link, not sure how it got upvoted when following it fails (there’s a trailing . after the domain). That’s kinda fishy... Correct link should be https://bugs.xdavidhu.me/google/2021/01/18/the-embedded-yout...
Adding the dot after the tld actually works on some sites to bypass paywalls.
And in the old days people were accustomed to be able to resolve local hostnames, without having to supply any domain part. The "search" keyword in resolv.conf is a remnant of this. By adding a final dot, you ensured that the domain part you wrote referred to the global DNS root, not any local one. Unless of course someone had changed "ndots" which controls how many dots are needed to disable the search feature.
Re: The embedded YouTube player told me what you were watching
#13$1,337 for watch history + liked videos + watch later disclosure? Requires user to visit a malicious site, yes, but still feels a bit skimpy.
> Requires user to visit a malicious site
YouTube embeds are such universal things on the web, I doubt anyone would even think twice about security concerns coming from seeing that on a third-party site.
Because it's Google, right? /s
Re: The embedded YouTube player told me what you were watching
#14doesn't google employ the elite of world programming? how can such stuff even happen? honest question.
Re: The embedded YouTube player told me what you were watching
#15doesn't google employ the elite of world programming? how can such stuff even happen? honest question.
Probably due to the scale they're operating at. Maybe there were parts of things that didn't have such a vulnerability alone but did when put together. Maybe there isn't a clear owner of the code so no one felt responsible to find and patch such a thing. Maybe the entire system is too complex for one or even a small team of developers to grok so things can easily slip through the cracks from time to time.
Re: The embedded YouTube player told me what you were watching
#16doesn't google employ the elite of world programming? how can such stuff even happen? honest question.
No, Google employs far too many developers for the median to be close to 'elite'. I'm sure there are elite teams at Google, but I very much doubt the average Googler is, and that's probably been the case for a decade at this point. The famous Rob Pike quote sums it up quite well:
> The key point here is our programmers are Googlers, they’re not researchers. They’re typically, fairly young, fresh out of school, probably learned Java, maybe learned C or C++, probably learned Python. They’re not capable of understanding a brilliant language but we want to use them to build good software.
Re: The embedded YouTube player told me what you were watching
#17doesn't google employ the elite of world programming? how can such stuff even happen? honest question.
WAANK doesn't always hire the best people. Most I interviewed from these were average. They did know how to solve high school algorithms tho.
Re: The embedded YouTube player told me what you were watching
#18doesn't google employ the elite of world programming? how can such stuff even happen? honest question.
No evolving application can be or stay free of bugs or security concerns, regardless of the people or company behind it.
Re: The embedded YouTube player told me what you were watching
#19Re: The embedded YouTube player told me what you were watching
#20doesn't google employ the elite of world programming? how can such stuff even happen? honest question.
Only for the backend.