Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Leaking YouTube creators' private videos

javoriuski.com

Post reply on HN
Print view View original

161–170 of 436 posts

Re: Leaking YouTube creators' private videos

#161

Post by t-3 »

charcircuit wrote: post #133
zahlman wrote: post #105

Earlier quoted context omitted.

The web really doesn't, and shouldn't, depend on these things. I use a JavaScript whitelisting tool, so that I can allow JavaScript on pages where it's merited, when the trust for that functionality has been earned. Nowadays it's used for things that have been possible in plain HTML for decades. In this case, text has been added to HTML that causes otherwise visible text not to display, presumably so that it can fade…

You are smacking your own face by disabling it. Instead of trying to get the entire world to conform to the requirements of your special browser, why won't you have your browser conform to the needs of the world.

I don't want pop ups, ads, cookies, gdpr nagging, tracking pixels, autoplaying videos or malicious exploits. If those are the requirements of the world to read a basic article, then fuck the world!

Re: Leaking YouTube creators' private videos

#162

Post by beambot »

NamTaf wrote: post #149
Mg6yDfjp5U wrote: post #10

I recently left Google having worked on a number of projects with various YouTube teams. I think I can explain why it's being handled this way by YouTube. This is a fairly nuanced/involved issue, so the task of classifying the bug likely made it's way to one of the engineers responsible for the implementation of this feature. That engineer has already launched this project, and filed it away under their GRAD (perform…

[flagged]

The entire rail industry suffers from massive deferred maintenance issues that manifest as serious safety concerns. This shit happens in every industry: dieselgate, 737max, flint water crisis, PG&E camp fire, etc. Let's not pretend one engineering discipline is holier than thou -- especially when the consequences are derailments versus some leaked youtube videos.

Re: Leaking YouTube creators' private videos

#163

Post by Arainach »

mschuster91 wrote: post #160
NamTaf wrote: post #149

Earlier quoted context omitted.

[flagged]

> This is a prime example of why programmers are not seriously considered engineers. The problem isn't the programmers ffs. In your industry, if your superior orders you (or creates the incentive) to hide bad stuff under the rug, you have the ability to push back, at least to some degree. Programmers? We don't have that. Maybe the few of us who actually work on security critical stuff, but some generic AI BS? No chan…

All sorts of employees are treated as disposable. The issue is absolutely that software engineers have no culture of responsibility or safety and no professional licensing group to enforce it for them.

Re: Leaking YouTube creators' private videos

#164

Post by brailsafe »

NamTaf wrote: post #149
Mg6yDfjp5U wrote: post #10

I recently left Google having worked on a number of projects with various YouTube teams. I think I can explain why it's being handled this way by YouTube. This is a fairly nuanced/involved issue, so the task of classifying the bug likely made it's way to one of the engineers responsible for the implementation of this feature. That engineer has already launched this project, and filed it away under their GRAD (perform…

[flagged]

> This is a prime example of why programmers are not seriously considered engineers.

Seems to me like your comment is simply an example of prejudice.

You're just describing another standardized incentive structure that you're operating in, and using that as a basis to extrapolate that programmers of all kinds—whether they work on a video platform or on machinery that could cause catastrophe if it fails—are implicitly careless careerists who refuse responsibility by nature.

Re: Leaking YouTube creators' private videos

#165

Post by boredatoms »

ghurtado wrote: post #42
Mg6yDfjp5U wrote: post #10

I recently left Google having worked on a number of projects with various YouTube teams. I think I can explain why it's being handled this way by YouTube. This is a fairly nuanced/involved issue, so the task of classifying the bug likely made it's way to one of the engineers responsible for the implementation of this feature. That engineer has already launched this project, and filed it away under their GRAD (perform…

Of all the fucked up things in this comment, giving a single Engineer lifetime responsibility for all bugs in code they wrote is probably the dumbest. And it's slowly becoming the norm. The last place I worked at, a large and well known Tech company, didn't even roll with QA's. That just wasn't a role anywhere in the division. You are fully responsible for all the bugs in all the code you ever wrote Cute at first. Un…

Lifetime is too much. One or two re-orgs at most.

People only spend a couple of years at each company anyway

Re: Leaking YouTube creators' private videos

#166

Post by m00x »

fathermarz wrote: post #157
NamTaf wrote: post #149

Earlier quoted context omitted.

[flagged]

I think there is a fine line. YouTube is not critical software and no one’s life depends on the safety (putting mental health aside) of the code running. Some software engineers do however write code that is critical, but to your point, I don’t think they are ever considered liable. I went through an acquisition as a Canadian software developer getting acquired by an American company. They wanted us to be called engi…

Youtube should consider their engineers responsible for the software they write. Big companies these days are just bureaucracy tricks and politics. There's a small handful of real talent, but they're quickly moving to new startups.

Also, I'm Canadian as well, and almost everyone calls themselves "software engineer" these days. You just can't say P.eng. in your title. You could be forced to remove it from linkedin/etc if you're called out, but it rarely happens.

Re: Leaking YouTube creators' private videos

#167

Post by tyrust »

Why doesn't the article contain proof of either attack in action?

I would be surprised if the second attack worked after what must be at least a couple layers of markdown/html conversion and spam filtering.

disclaimer: work at Google, but far removed from YouTube

Re: Leaking YouTube creators' private videos

#168

Post by mschuster91 »

mk89 wrote: post #140
weitendorf wrote: post #73

Earlier quoted context omitted.

I disagree with this pretty strongly. If you’re not going to take responsibility for your bugs I don’t want to work with you. Don’t make other people QA your work; if you’re not able to figure out how to do that yourself while you work you’re legitimately bad at your job. Once you leave an employer obviously you have no obligation to fix bugs in IP you don’t own or anything.

OP used the word "lifetime" which makes a key difference. I don't want to be responsible for a bug in my 8 years old code, which I probably even forgot how it worked etc. I probably don't even work anymore in the same team or on the same service. Why the hell should I be responsible and how is this sustainable? I am not even sure if your criticism makes any sense at all anymore nowadays. AI is writing 80% of the code…

> Why the hell should I be responsible and how is this sustainable?

Well, it works for professional engineers, you know, the people designing bridges, tunnels, heavy machinery, aircraft, spacecraft or medical instruments. When something happens and they can't show that their work adhered to the generally accepted best standards at the time... they're held liable. And sometimes, that liability includes jail time, particularly when people are seriously injured or die.

And how it is sustainable? Simple: legal requirements that force managers to allot enough time and tooling to their engineering teams, because engineers whose professional license is on the line will rather quit than be forced to sign off something that is unsafe.

In the software world, this might result in AI not being used at all - simply put: no matter what, AI in its current form is always going to be vulnerable to in-band attacks, or to use an older term... phreaking [1]. It might result in software having to go through formal proof programs, fuzzers, whatever. It might result in entire programming languages just being outright banned in production code in favor of programming languages that eliminate entire classes of vulnerabilities.

And before the usual "but China/India/... would outcompete us" complaints come... well, have you ever seen a Chinese widebody airliner in Western airspace? No. Because China is not able to pass over the engineering gates we have set in place. We could easily do the same with software.

Requiring at least some sort of quality gates on software would not be bad for you as a programmer. Quite the contrary: it would hand you power over your incompetent beancounter boss.

[1] https://en.wikipedia.org/wiki/Phreaking

Re: Leaking YouTube creators' private videos

#169

Post by [deleted] »

throwrioawfo wrote: post #58
Mg6yDfjp5U wrote: post #10

I recently left Google having worked on a number of projects with various YouTube teams. I think I can explain why it's being handled this way by YouTube. This is a fairly nuanced/involved issue, so the task of classifying the bug likely made it's way to one of the engineers responsible for the implementation of this feature. That engineer has already launched this project, and filed it away under their GRAD (perform…

I feel like things have become so much more cynical in the last 5 years, in this regard. I feel like part of it is the "over-systemization" of promos. I see the logic behind it to some extent - if there's a system, it's "fairer"/"more democratic". But, then we end up with ridiculous gamified promo systems.

[deleted]

Re: Leaking YouTube creators' private videos

#170

Post by [deleted] »

brailsafe wrote: post #164
NamTaf wrote: post #149

Earlier quoted context omitted.

[flagged]

> This is a prime example of why programmers are not seriously considered engineers. Seems to me like your comment is simply an example of prejudice. You're just describing another standardized incentive structure that you're operating in, and using that as a basis to extrapolate that programmers of all kinds—whether they work on a video platform or on machinery that could cause catastrophe if it fails—are implicitly…

[deleted]
Post reply on HN