Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The embedded YouTube player told me what you were watching

bugs.xdavidhu.me

Post reply on HN
Print view View original

71–80 of 112 posts

Re: The embedded YouTube player told me what you were watching

#71

Post by satya71 »

sbarre wrote: post #13
taldo wrote: post #8

$1,337 for watch history + liked videos + watch later disclosure? Requires user to visit a malicious site, yes, but still feels a bit skimpy.

> Requires user to visit a malicious site YouTube embeds are such universal things on the web, I doubt anyone would even think twice about security concerns coming from seeing that on a third-party site. Because it's Google, right? /s

Strangely, I almost never allow YouTube embeds (or for that matter any embeds) using uMatrix. I click the pop out link that appears in its place.

Re: The embedded YouTube player told me what you were watching

#72

Post by robocat »

xirbeosbwo1234 wrote: post #28
bidirectional wrote: post #16

Earlier quoted context omitted.

No, Google employs far too many developers for the median to be close to 'elite'. I'm sure there are elite teams at Google, but I very much doubt the average Googler is, and that's probably been the case for a decade at this point. The famous Rob Pike quote sums it up quite well: > The key point here is our programmers are Googlers, they’re not researchers. They’re typically, fairly young, fresh out of school, probab…

I think Rob Pike's commentary on Go is why I decided to go into research. Google hires kilotons of developers and pays them gigadollars every year, then makes them work in dumbed-down languages because they can't be trusted with power tools. How has our industry gone so far astray that we pay people hundreds of thousands of dollars a year when they can't even understand generics? In what universe does it make sense t…

> then makes them work in dumbed-down languages because they can't be trusted with power tools.

The languages are “dumbed” down so that the resulting code is intelligible to those that work on the system, so that the code is communication.

Overly smart tools allow a smart person to make mistakes so complicated that nobody can fix it (even themselves). Or a smart person builds great solutions so complex that nobody else can work on the code.

A good engineer chooses restrictions that help themselves and others build better solutions that a team can work on.

Re: The embedded YouTube player told me what you were watching

#73

Post by Lorin »

taldo wrote: post #8

$1,337 for watch history + liked videos + watch later disclosure? Requires user to visit a malicious site, yes, but still feels a bit skimpy.

Agreed, as an example this could have been exploited by leak sites to get unlisted videos prior to public announcements/launches.

Re: The embedded YouTube player told me what you were watching

#74

Post by [deleted] »

stretchcat wrote: post #60
anonymousab wrote: post #36

Earlier quoted context omitted.

Professionals with many years of experience could and would still make mistakes with C and C++. And many mistakes are very costly at Google's scale. Wanting to make the situation better through a simpler, safer fit-for-purpose tool doesn't mean an industry is flawed anymore than the prevalence of sawstops means that carpentry is flawed.

Holy spin. Rob Pike was explicitly talking about young inexperienced programmers who are 'not capable of understanding a brilliant language.' He wasn't talking about experienced developers and made that as clear as he possibly could. Go is made simple for novices, not safe for veterans.

[deleted]

Re: The embedded YouTube player told me what you were watching

#75

Post by TedDoesntTalk »

oh_sigh wrote: post #65
fredley wrote: post #29

Earlier quoted context omitted.

It's not about you, it's about your parents and grandparents.

My grandmom was a programmer on a university mainframe in the 50s and learned haskell in her 90s

My grandma programmed an arduino with stepper motors to change her Depends adult diapers. It does not yet auto-detect wet diapers but that’s next on the road map.

Re: The embedded YouTube player told me what you were watching

#77

Post by [deleted] »

grlass wrote: post #42
mosselman wrote: post #38

Earlier quoted context omitted.

Ageist how? Who says you have to be a certain age to be a parent or grandparent? Sounds very ageist to me. And that is an example of how political correctness is an arms race.

You misunderstand: it's ageist to suggest that parents and grandparents are by definition not likely to be technical enough to use mitigations like containers and such. Which it is.

[deleted]

Re: The embedded YouTube player told me what you were watching

#78

Post by josefx »

Lorin wrote: post #73
taldo wrote: post #8

$1,337 for watch history + liked videos + watch later disclosure? Requires user to visit a malicious site, yes, but still feels a bit skimpy.

Agreed, as an example this could have been exploited by leak sites to get unlisted videos prior to public announcements/launches.

Unlisted? This also seems to apply to private videos? There was a recent exploit that let you copy private videos frame by frame if you had the address.

Re: The embedded YouTube player told me what you were watching

#79

Post by bigiain »

gambiting wrote: post #68
oh_sigh wrote: post #65

Earlier quoted context omitted.

My grandmom was a programmer on a university mainframe in the 50s and learned haskell in her 90s

Great. 99.999999999% grandmothers weren't.

And let face it, 99.999999999% of the pedantic privacy-performative Hackernews posters will also browse the web exclusively in Chrome while logged in to Youtube (and Facebook and Twitter and and and)...
Post reply on HN