Leaking YouTube creators' private videos • Hacker News Board

Re: Leaking YouTube creators' private videos

#171

Post by manquer » Sat, Jul 04, 2026, 8:23 PM UTC

bartread wrote: post #145

ismailmaj wrote: post #127

Earlier quoted context omitted.

I'll pick small company, thank you.

This isn’t a bad approach but it’s not a panacea: small companies can be pretty messed up too, albeit perhaps in different ways.

The impact is local though, it would be only a problem if the median small company is more messed up than the large co.

It not likely to happen because being small there are more threats or market forces to deal with so they cannot do as they please. Monopolies or just economies of scale affords large co and the small number of executives that control them outsized influence - both good and bad.

Re: Leaking YouTube creators' private videos

#172

Post by HelloMcFly » Sat, Jul 04, 2026, 8:26 PM UTC

NamTaf wrote: post #149

Mg6yDfjp5U wrote: post #10

I recently left Google having worked on a number of projects with various YouTube teams. I think I can explain why it's being handled this way by YouTube. This is a fairly nuanced/involved issue, so the task of classifying the bug likely made it's way to one of the engineers responsible for the implementation of this feature. That engineer has already launched this project, and filed it away under their GRAD (perform…

[flagged]

"The rat is always right." - B.F. Skinner.

When the rat presses a lever, don't blame the rat. This is super reductionist of course, but I always keep it in mind.

Re: Leaking YouTube creators' private videos

#173

Post by c-hendricks » Sat, Jul 04, 2026, 8:27 PM UTC

t-3 wrote: post #161

charcircuit wrote: post #133

Earlier quoted context omitted.

You are smacking your own face by disabling it. Instead of trying to get the entire world to conform to the requirements of your special browser, why won't you have your browser conform to the needs of the world.

I don't want pop ups, ads, cookies, gdpr nagging, tracking pixels, autoplaying videos or malicious exploits. If those are the requirements of the world to read a basic article, then fuck the world!

I hear you, but only 2 of those things require JavaScript.

Re: Leaking YouTube creators' private videos

#174

Post by snailmailman » Sat, Jul 04, 2026, 8:27 PM UTC

CMay wrote: post #156

In the example provided of leaking a private video, you already need access to the private video to even comment on it. That scenario is not much of an exploit. Unless there's a better example of what can be abused, the more realistic concern is authority laundering where a command tricks YouTube into giving the user instructions that sound like they're coming from Google. Another risk is using it to get the AI to mi…

I think the comment can be left on any video on the channel?

Re: Leaking YouTube creators' private videos

#175

Post by brailsafe » Sat, Jul 04, 2026, 8:30 PM UTC

Arainach wrote: post #163

mschuster91 wrote: post #160

Earlier quoted context omitted.

> This is a prime example of why programmers are not seriously considered engineers. The problem isn't the programmers ffs. In your industry, if your superior orders you (or creates the incentive) to hide bad stuff under the rug, you have the ability to push back, at least to some degree. Programmers? We don't have that. Maybe the few of us who actually work on security critical stuff, but some generic AI BS? No chan…

All sorts of employees are treated as disposable. The issue is absolutely that software engineers have no culture of responsibility or safety and no professional licensing group to enforce it for them.

> no culture of responsibility or safety and no professional licensing group to enforce it for them.

Naturopaths and chiropractors are licensed to do various things too, physicians, etc.. a license does not imply that there would otherwise exist a culture of responsibility, foundation in evidence or anything of the sort. It's an incentive structure and regulatory practice. One may even keep their license while being a monster and abusing other incentive structures that don't have a bearing on that license.

Software engineers are not typically licensed as engineers, that's all one can say without dipping into prejudice.

Re: Leaking YouTube creators' private videos

#176

Post by dizhn » Sat, Jul 04, 2026, 8:30 PM UTC

sdevonoes wrote: post #148

UnlockedSecrets wrote: post #95

Earlier quoted context omitted.

Youtube launched 1 year and 8 months before being acquired by google.... It's largely semantics to say that what Youtube is today, isn't a direct result of Google's ownership for nearly 20 years now....

What YT is now: - ads every now and then - addictive shorts no one needs - suggested videos nobody asked for - geo ban of videos

No concept of language in a user facing way. No filter by language no search by language. On the contrary searches are translated before running and return all languages, videos are dubbed even when you speak the original language, same but with titles being translated etc. Search being shit is kind of on par with being a Google product though. I wonder if they had any language preferences before Google bought them. I don't remember that far back.

Re: Leaking YouTube creators' private videos

#177

Post by bagels » Sat, Jul 04, 2026, 8:32 PM UTC

HelloMcFly wrote: post #172

NamTaf wrote: post #149

Earlier quoted context omitted.

[flagged]

"The rat is always right." - B.F. Skinner. When the rat presses a lever, don't blame the rat. This is super reductionist of course, but I always keep it in mind.

It's worse than that. Google will get rid of you if you are just fixing bugs. Ergo, the people who are inclined to fix are forced out or forced not to fix.

Re: Leaking YouTube creators' private videos

#178

Post by dizhn » Sat, Jul 04, 2026, 8:32 PM UTC

vlovich123 wrote: post #55

ghurtado wrote: post #42

Earlier quoted context omitted.

Of all the fucked up things in this comment, giving a single Engineer lifetime responsibility for all bugs in code they wrote is probably the dumbest. And it's slowly becoming the norm. The last place I worked at, a large and well known Tech company, didn't even roll with QA's. That just wasn't a role anywhere in the division. You are fully responsible for all the bugs in all the code you ever wrote Cute at first. Un…

Ok. So QA finds a bug. Who’s responsible for fixing it? The only value of QA is to try to make sure you become aware of issues before customers find them

QA probably has their own promotion path that doesn't involve finding bugs. :)

Re: Leaking YouTube creators' private videos

#179

Post by [deleted] » Sat, Jul 04, 2026, 8:32 PM UTC

charcircuit wrote: post #133

zahlman wrote: post #105

Earlier quoted context omitted.

The web really doesn't, and shouldn't, depend on these things. I use a JavaScript whitelisting tool, so that I can allow JavaScript on pages where it's merited, when the trust for that functionality has been earned. Nowadays it's used for things that have been possible in plain HTML for decades. In this case, text has been added to HTML that causes otherwise visible text not to display, presumably so that it can fade…

You are smacking your own face by disabling it. Instead of trying to get the entire world to conform to the requirements of your special browser, why won't you have your browser conform to the needs of the world.

[deleted]

Re: Leaking YouTube creators' private videos

#180

Post by j45 » Sat, Jul 04, 2026, 8:33 PM UTC

brailsafe wrote: post #164

NamTaf wrote: post #149

Earlier quoted context omitted.

[flagged]

> This is a prime example of why programmers are not seriously considered engineers. Seems to me like your comment is simply an example of prejudice. You're just describing another standardized incentive structure that you're operating in, and using that as a basis to extrapolate that programmers of all kinds—whether they work on a video platform or on machinery that could cause catastrophe if it fails—are implicitly…

I understand the direction of your comment, engineering doesn't guarantee security either.

Hubris is the single biggest downfall, whether it's pegged on insecurity, or a false sense of knowledge, superiority or entitlement.

The very best and most experienced people I know have deep expertise, and maintain a healthy mistrust of their own work to keep an eye on it and improving it.

Real world experience and run history is a big thing, and people can re-learn the lessons of the past over and over with their egos, or also be open to learning from others to learn quicker.