I hear heads rolling...
Leaking the email of any YouTube user for $10k
51–60 of 487 posts
Re: Leaking the email of any YouTube user for $10k
#52Is it me or are all the dates in this timeline in the future? Isn’t it Feb 2025 now? Do you smell toast? EDIT: oh I see .. DD/MM/YY is a new one to me
MM/DD/YY is an exclusively American standard https://en.wikipedia.org/wiki/List_of_date_formats_by_countr... I have no idea why America settled on MM/DD/YY, which seems like absolutely the least intuitive permutation of D, M, and Y. Except perhaps MYD.
Canada uses this also, though we also use day-month-year and year-month-day.
Yes, this effectively makes dates nearly impossible to decipher here.
Re: Leaking the email of any YouTube user for $10k
#53This is a puny payout IMO. If they poked around a bit more they may have found a better GAIA->Email vulnerability or perhaps could just use the one they found. A database of emails for every major youtube channel would be worth an awful lot.
Serverside vulnerabilities have essentially no market outside of bug bounties. This is a hell of a payout for a web finding.
Re: Leaking the email of any YouTube user for $10k
#54Re: Leaking the email of any YouTube user for $10k
#55Earlier quoted context omitted.
Unfortunately with the number of users Google has, any deprecation will be met with cries of pain / I-rely-on-the-spacebar-to-heat-up-my-computer. See https://killedbygoogle.com/ .
They really aren't shy about massive breaking changes. I'm still upset about Google Reader. https://killedbygoogle.com/
Many of us are still upset about Reader. It definitely felt like a watershed moment between the old cool Google who sent pizzas to hackers and had clean fast web design and weren't evil.
I'd be so glad now to give up on Google and all its enshittified shit. I could give up things that are still super useful and I get value from every day: YouTube, Gmail, Play Services, Drive, Maps. But I don't think I could give them all up at once. I've been trying to migrate to Proton and OpenStreetMap and some kind of real Linux phone etc, I don't even mind if I have to fiddle around before everything works. The trouble is that the claws are in, but they're not in me.
Remember when Google proudly didn't advertise themselves? They got to critical mass through word of mouth, from having a compellingly better product. Now what they have is network effects and locking. They used to appeal to developers and techies because and that ended up making the services better for everyone. Now like all the other tech giants they have PHB's optimizing for the next millisecond of attention and Microdollar of ad revenue from a lowest-common-denominator victim.
Google is so big that it's a significant part of life for a significant proportion of the world. When Google is shit it moves the needle on net human suffering. I think the UN should be focussing on prevent war and trying to salvage our environment, but if they aren't going to do that then it might be rational to just form a worldwide consumer group to take on megacorps.
Re: Leaking the email of any YouTube user for $10k
#56Re: Leaking the email of any YouTube user for $10k
#57$10k seems too small, for discovering a bad security mess-up by employees each getting paid 20 to 70 times that amount (or more).
Re: Leaking the email of any YouTube user for $10k
#58Earlier quoted context omitted.
Side note, what is that reference from? Searching "i rely on the spacebar to heat up my computer" directs me back to this comment (6 mins ago).
you're one of today's lucky 10,000
Re: Leaking the email of any YouTube user for $10k
#59Very nice breakdown. But while 10,000 dollars seems like a decent sum, I expected more for a bug of this severity, if I'm being honest. Especially as they initially only awarded 3100. But I'm not sure how much is usual for such cases. Almost 150 days also seems kind of a long time for fixing it imho.
$10k is not a decent sum. The compensation reflects roughly 0.25-3 weeks of SWE costs in payout. Industry-wide SWE compensation is somewhere in the $100k-$200k range. Typical Google SWE compensation is $350k. Top Google SWE salary is north of $1M. Increase by 60-100% for overhead, or somewhat more for consulting overhead. The amount of work doing something like this is orders of magnitude more than the compensation:…
It's an extraordinarily high sum for this kind of finding. Bounties are generally not a referendum on how clever the underlying work is. A full-chain iOS bug is worth hundreds of thousands of dollars because Apple competes with the grey market for it (and even then, it's an apples-oranges comparison and Apple pays substantially less than the rest of the market for structural reasons). Nobody competes for this bug; nobody is going to pay these people $10,001 for a bug that Google can end instantaneously the moment they figure out what's happening.
Re: Leaking the email of any YouTube user for $10k
#60“Applied 1 downgrade from the base amount due to complexity of attack chain required” I’ve only participated in a few vulnerability programs, and most of them reward less if the security flaw is stupidly simple (but serious) such as revealing user emails in the page source.
I had the opposite impression, that it got dinged for being relatively complex for a web finding.