Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Leaking YouTube creators' private videos

javoriuski.com

Post reply on HN
Print view View original

71–80 of 436 posts

Re: Leaking YouTube creators' private videos

#71

Post by zahlman »

rwmj wrote: post #15
algoth1 wrote: post #2

Google doesnt care about prompt injection attacks??? This is insane

Can they do anything about it? It's a fundamental flaw in how data is fed to LLMs. I'm getting PHP / SQL injection flashbacks.

The described attack sounds like it's expecting the human to forget about having just clicked a UI element asking for a comment summary, and responding to a comment summary that tries to sound like an "important message from YouTube" as if it were actually such. It doesn't seem to involve the LLM actually having any agency to, for example, send an email to the creator.

Mitigations would include ensuring it doesn't have that agency, and adding framing text to the reply, and perhaps disabling Markdown formatting of the reply.

But also, the leak is being talked up quite a bit:

> Private video titles aren't just metadata. They can reveal unreleased content, unannounced projects and sensitive personal material.

Putting "sensitive personal material" in the title of a YouTube video upload and relying on YouTube to keep the video "private" seems like a terrible idea in the first place, and at best pointless.

Re: Leaking YouTube creators' private videos

#72

Post by Mg6yDfjp5U »

varispeed wrote: post #62
Mg6yDfjp5U wrote: post #10

I recently left Google having worked on a number of projects with various YouTube teams. I think I can explain why it's being handled this way by YouTube. This is a fairly nuanced/involved issue, so the task of classifying the bug likely made it's way to one of the engineers responsible for the implementation of this feature. That engineer has already launched this project, and filed it away under their GRAD (perform…

> This is a fairly nuanced/involved issue Is it though?

Definitely. The front line support agents handle only the most basic requests. Anything even remotely complicated, such as this, would be internally kicked around until they found someone familiar with the project to give input. Which most likely is someone who worked on the original implementation.

Re: Leaking YouTube creators' private videos

#73

Post by weitendorf »

ghurtado wrote: post #42
Mg6yDfjp5U wrote: post #10

I recently left Google having worked on a number of projects with various YouTube teams. I think I can explain why it's being handled this way by YouTube. This is a fairly nuanced/involved issue, so the task of classifying the bug likely made it's way to one of the engineers responsible for the implementation of this feature. That engineer has already launched this project, and filed it away under their GRAD (perform…

Of all the fucked up things in this comment, giving a single Engineer lifetime responsibility for all bugs in code they wrote is probably the dumbest. And it's slowly becoming the norm. The last place I worked at, a large and well known Tech company, didn't even roll with QA's. That just wasn't a role anywhere in the division. You are fully responsible for all the bugs in all the code you ever wrote Cute at first. Un…

I disagree with this pretty strongly. If you’re not going to take responsibility for your bugs I don’t want to work with you.

Don’t make other people QA your work; if you’re not able to figure out how to do that yourself while you work you’re legitimately bad at your job.

Once you leave an employer obviously you have no obligation to fix bugs in IP you don’t own or anything.

Re: Leaking YouTube creators' private videos

#74

Post by [deleted] »

b-kf wrote: post #9

bit meta but can I just applaud the article? Descriptive title, immediately comes to the point, no elaborate fluff, factual... what a nice change of pace. 95% of other users finding this would have done much worse. This is not clickbait, not calling for a social media campaign, has no embedded tweets of interaction with Google engineers trying to shame them, no singling out of individuals, ... Not sure if a user post…

[deleted]

Re: Leaking YouTube creators' private videos

#75

Post by dooglius »

citizenpaul wrote: post #29
ronbenton wrote: post #22

Earlier quoted context omitted.

Glad to hear this is a universal big tech experience. The promo process is entirely antithetical to shipping good products

What do you mean? Youtube is unquestionably one of the most successful projects ever launched? Seems like the process works astoundingly well.

Did the promo process exist at YouTube's creation?

Re: Leaking YouTube creators' private videos

#76

Post by thx67 »

mid-kid wrote: post #46
citizenpaul wrote: post #29

Earlier quoted context omitted.

What do you mean? Youtube is unquestionably one of the most successful projects ever launched? Seems like the process works astoundingly well.

Youtube survives on google's massive repertoire of products being vastly more profitable, not because it's the best of its kind.

And free bandwdith. Free bandwidth is nice.

Re: Leaking YouTube creators' private videos

#77

Post by cdbdbspt »

Mg6yDfjp5U wrote: post #10

I recently left Google having worked on a number of projects with various YouTube teams. I think I can explain why it's being handled this way by YouTube. This is a fairly nuanced/involved issue, so the task of classifying the bug likely made it's way to one of the engineers responsible for the implementation of this feature. That engineer has already launched this project, and filed it away under their GRAD (perform…

I also used to work at Google and what you have described is not the way the VRP works at all.

1. The engineers on the VRP teams set the severity of the bug based on impact. The engineering team responsible for the fix can argue the severity but only if they can show there is some other mitigating factor that the VRP team wasn't aware of.

2. Google has a great security culture and while it may be true that maintaining existing code may not be as sexy as building new features, fixing vulnerabilities does look good on GRAD (performance) because the impact is already well documented.

3. Believe it or not, the VRP team does like to give away rewards. However, to do this, they have to follow a rubric to keep all of the payouts consistent and fair.

4. Constructive and polite discourse is welcome and a researcher may reply to their bug asking for more details or to make their case in the event that they think the VRP team did not understand the severity. The team is made up of humans who are open to the idea that they missed something in the initial report. They, like all other bug bounty programs, are also struggling to keep up with the huge influx of AI generated slop so mistakes can happen.

Re: Leaking YouTube creators' private videos

#78

Post by sscaryterry »

Mg6yDfjp5U wrote: post #10

I recently left Google having worked on a number of projects with various YouTube teams. I think I can explain why it's being handled this way by YouTube. This is a fairly nuanced/involved issue, so the task of classifying the bug likely made it's way to one of the engineers responsible for the implementation of this feature. That engineer has already launched this project, and filed it away under their GRAD (perform…

The rot is deep.

Re: Leaking YouTube creators' private videos

#79

Post by tiahura »

ronbenton wrote: post #22
Mg6yDfjp5U wrote: post #10

I recently left Google having worked on a number of projects with various YouTube teams. I think I can explain why it's being handled this way by YouTube. This is a fairly nuanced/involved issue, so the task of classifying the bug likely made it's way to one of the engineers responsible for the implementation of this feature. That engineer has already launched this project, and filed it away under their GRAD (perform…

Glad to hear this is a universal big tech experience. The promo process is entirely antithetical to shipping good products

Sweep it under the rug is not limited to any paticular industry.

Re: Leaking YouTube creators' private videos

#80

Post by Aunche »

ronbenton wrote: post #22
Mg6yDfjp5U wrote: post #10

I recently left Google having worked on a number of projects with various YouTube teams. I think I can explain why it's being handled this way by YouTube. This is a fairly nuanced/involved issue, so the task of classifying the bug likely made it's way to one of the engineers responsible for the implementation of this feature. That engineer has already launched this project, and filed it away under their GRAD (perform…

Glad to hear this is a universal big tech experience. The promo process is entirely antithetical to shipping good products

I don't think it's the promo process itself. If the bug was something that actually affects Google's bottom line, I guarantee that Google would find a way such that the engineer would be incentivized to fix it.
Post reply on HN