Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The embedded YouTube player told me what you were watching

bugs.xdavidhu.me

Post reply on HN
Print view View original

41–50 of 112 posts

Re: The embedded YouTube player told me what you were watching

#41

Post by spion »

xirbeosbwo1234 wrote: post #28
bidirectional wrote: post #16

Earlier quoted context omitted.

No, Google employs far too many developers for the median to be close to 'elite'. I'm sure there are elite teams at Google, but I very much doubt the average Googler is, and that's probably been the case for a decade at this point. The famous Rob Pike quote sums it up quite well: > The key point here is our programmers are Googlers, they’re not researchers. They’re typically, fairly young, fresh out of school, probab…

I think Rob Pike's commentary on Go is why I decided to go into research. Google hires kilotons of developers and pays them gigadollars every year, then makes them work in dumbed-down languages because they can't be trusted with power tools. How has our industry gone so far astray that we pay people hundreds of thousands of dollars a year when they can't even understand generics? In what universe does it make sense t…

Its simple: he is not really a legend at all.

Re: The embedded YouTube player told me what you were watching

#42

Post by grlass »

mosselman wrote: post #38
xphx wrote: post #37

Earlier quoted context omitted.

It's an ageist way of saying that this exploit is less critical for people who take proactive counter-measures, and more affects less technically inclined or security-minded people.

Ageist how? Who says you have to be a certain age to be a parent or grandparent? Sounds very ageist to me. And that is an example of how political correctness is an arms race.

You misunderstand: it's ageist to suggest that parents and grandparents are by definition not likely to be technical enough to use mitigations like containers and such.

Which it is.

Re: The embedded YouTube player told me what you were watching

#44

Post by Nextgrid »

sbarre wrote: post #13
taldo wrote: post #8

$1,337 for watch history + liked videos + watch later disclosure? Requires user to visit a malicious site, yes, but still feels a bit skimpy.

> Requires user to visit a malicious site YouTube embeds are such universal things on the web, I doubt anyone would even think twice about security concerns coming from seeing that on a third-party site. Because it's Google, right? /s

Do you actually need to see it? The exploit should work fine even if the player is not visible.

Re: The embedded YouTube player told me what you were watching

#46

Post by sascha_sl »

eternalsculptor wrote: post #34
xirbeosbwo1234 wrote: post #28

Earlier quoted context omitted.

I think Rob Pike's commentary on Go is why I decided to go into research. Google hires kilotons of developers and pays them gigadollars every year, then makes them work in dumbed-down languages because they can't be trusted with power tools. How has our industry gone so far astray that we pay people hundreds of thousands of dollars a year when they can't even understand generics? In what universe does it make sense t…

>can't understand generics Is this really true? We learned about generics in college so I assumed that everyone knew it (especially if they work at Google).

OP is taking a swing at Go's lack of generics.

Just because a language focuses on simplicity does not automatically make it bad. People use Go to solve complex issues, so it makes total sense none of that working memory should be occupied with understanding language features, even if they're as simple as generics.

A more extreme way to write Go is "space shuttle style" Code, as used in the Kubernetes Volume Controller, a radically different approach to "I want all my complex features that I can use to shoot myself in the foot".

You might be able to handle a firearm, but we have plenty of injuries and deaths through mishandled firearms every year, don't think you're exempt from that (or if you insist, at least do not talk down the need for safety).

https://github.com/kubernetes/kubernetes/blob/master/pkg/con...

Re: The embedded YouTube player told me what you were watching

#47

Post by NegativeLatency »

saddlerustle wrote: post #32
xirbeosbwo1234 wrote: post #28

Earlier quoted context omitted.

I think Rob Pike's commentary on Go is why I decided to go into research. Google hires kilotons of developers and pays them gigadollars every year, then makes them work in dumbed-down languages because they can't be trusted with power tools. How has our industry gone so far astray that we pay people hundreds of thousands of dollars a year when they can't even understand generics? In what universe does it make sense t…

The skills the median google engineer needs can absolutely be learned in three months at a boot camp but simultaneously those skills are worth a million a year to google. There's massive returns to scale of the infrastructure for effective software development, but very few organisations have figured it out.

having a near monopoly on online ad sales and search doesn’t hurt either

Re: The embedded YouTube player told me what you were watching

#48

Post by wizzwizz4 »

mosselman wrote: post #38
xphx wrote: post #37

Earlier quoted context omitted.

It's an ageist way of saying that this exploit is less critical for people who take proactive counter-measures, and more affects less technically inclined or security-minded people.

Ageist how? Who says you have to be a certain age to be a parent or grandparent? Sounds very ageist to me. And that is an example of how political correctness is an arms race.

> And that is an example of how political correctness is an arms race.

Is it so hard to be nice?

Re: The embedded YouTube player told me what you were watching

#49

Post by xirbeosbwo1234 »

eternalsculptor wrote: post #34
xirbeosbwo1234 wrote: post #28

Earlier quoted context omitted.

I think Rob Pike's commentary on Go is why I decided to go into research. Google hires kilotons of developers and pays them gigadollars every year, then makes them work in dumbed-down languages because they can't be trusted with power tools. How has our industry gone so far astray that we pay people hundreds of thousands of dollars a year when they can't even understand generics? In what universe does it make sense t…

>can't understand generics Is this really true? We learned about generics in college so I assumed that everyone knew it (especially if they work at Google).

As someone else noted, I am taking a swing at Go's lack of generics.

More to the point, I am criticizing the reason for that. Designing a simple language is fine. I like simple languages a lot. Go was designed not because simple languages are good for some jobs but because Google decided their engineers aren't up to using more powerful tools.

I don't know Go. I've only written about 200 lines of it. I don't pretend to know whether or not it's any good. What I do know is that the reasoning behind it is bizarre to me.

Re: The embedded YouTube player told me what you were watching

#50

Post by kuroguro »

grlass wrote: post #42
mosselman wrote: post #38

Earlier quoted context omitted.

Ageist how? Who says you have to be a certain age to be a parent or grandparent? Sounds very ageist to me. And that is an example of how political correctness is an arms race.

You misunderstand: it's ageist to suggest that parents and grandparents are by definition not likely to be technical enough to use mitigations like containers and such. Which it is.

Haha, he's kind of right - there's two assumptions there. Saying grandparents are old and saying grandparents aren't technically inclined.
Post reply on HN