Live data from Hacker News

Leaking YouTube creators' private videos

javoriuski.com

181–190 of 436 posts

Re: Leaking YouTube creators' private videos

#181
post #71
post #15

Earlier quoted context omitted.

Can they do anything about it? It's a fundamental flaw in how data is fed to LLMs. I'm getting PHP / SQL injection flashbacks.

The described attack sounds like it's expecting the human to forget about having just clicked a UI element asking for a comment summary, and responding to a comment summary that tries to sound like an "important message from YouTube" as if it were actually such. It doesn't seem to involve the LLM actually having any agency to, for example, send an email to the creator. Mitigations would include ensuring it doesn't ha…

Its not hard to imagine this is a serious risk in some cases. For example: A youtuber essentially working as a journalist made a big story recently about some illegal actions of a lying and litigious company (Bricks and Minifigs story). The youtuber has a 3rd video ready for when his gag order drops, if that were to be released early he could find himself in jail.

Re: Leaking YouTube creators' private videos

#182

Earlier quoted context omitted.

This is what you get when the MBAs are in charge. They just go with P&L, Spreadsheets, etc. and care only about the current quarter and meeting the goals.

Google leadership has been from research/engineering and product backgrounds. This is how hierarchical businesses operate

Except leadership is largely not from employees moving up the rank

Sundar (CEO) is from Mcksinsley.

Ruth (President) is from Morgan Stanley.

TK (Cloud CEO) is from Oracle.

Mohan (YouTube CEO) is from DoubleClick which is Google at this point (~15 years).

---

Largely the story of the past several decades is that "doing your time" is a bad strategy. Always move to another company to go upwards.

Re: Leaking YouTube creators' private videos

#183

Earlier quoted context omitted.

This is what you get when the MBAs are in charge. They just go with P&L, Spreadsheets, etc. and care only about the current quarter and meeting the goals.

Google leadership has been from research/engineering and product backgrounds. This is how hierarchical businesses operate

Not really, in such large companies there's enormous selection pressure favoring career politicians. Maybe some of the survivors did some engineering at one point, but expertise fades fast when you stop getting your hands dirty. Most are empty suits.

Re: Leaking YouTube creators' private videos

#184
Welp, I reported a lot of AI prompt-injection bugs to various organizations, even some leading to RCE. They would say that they won't consider it as a bug, silently fix it and you are left there doing the work for free. I won't say "do not report stuff" but what's the point when companies are treating people like that, the incentive of finding and reporting bugs is literally zero nowadays.

Re: Leaking YouTube creators' private videos

#185
post #140

Earlier quoted context omitted.

OP used the word "lifetime" which makes a key difference. I don't want to be responsible for a bug in my 8 years old code, which I probably even forgot how it worked etc. I probably don't even work anymore in the same team or on the same service. Why the hell should I be responsible and how is this sustainable? I am not even sure if your criticism makes any sense at all anymore nowadays. AI is writing 80% of the code…

> Why the hell should I be responsible and how is this sustainable? Well, it works for professional engineers, you know, the people designing bridges, tunnels, heavy machinery, aircraft, spacecraft or medical instruments. When something happens and they can't show that their work adhered to the generally accepted best standards at the time... they're held liable. And sometimes, that liability includes jail time, part…

I think the problem I see with your argument is that people simply do not value reliable and secure consumer software as much as they'd value reliable and secure airplanes.

Of course, software that is in charge of things where people value security a lot, such as the software in airplanes, is much more scrutinized and adheres to better standards. This is the case precisely because when it goes bad people die in ways that attract a lot of attention.

You can't enforce those same policies on most consumer software because people consume it the same way they do food. You can have Michelin starred restaurants with the best practices but most people can't afford to eat there so instead they will buy hot dogs on the street.

The idea of "high quality hand crafted artisinal software" is closer to luxury products than it is to the engineering of planes, trains and bridges.

Re: Leaking YouTube creators' private videos

#186
post #180

Earlier quoted context omitted.

> This is a prime example of why programmers are not seriously considered engineers. Seems to me like your comment is simply an example of prejudice. You're just describing another standardized incentive structure that you're operating in, and using that as a basis to extrapolate that programmers of all kinds—whether they work on a video platform or on machinery that could cause catastrophe if it fails—are implicitly…

I understand the direction of your comment, engineering doesn't guarantee security either. Hubris is the single biggest downfall, whether it's pegged on insecurity, or a false sense of knowledge, superiority or entitlement. The very best and most experienced people I know have deep expertise, and maintain a healthy mistrust of their own work to keep an eye on it and improving it. Real world experience and run history…

It's not hubris (for the engineer) in this case though. It is the fact that company X knows that its dept Y can thrive with 10 engineers, and stay afloat with 5 engineers, so the magic number is 5. And then it is down to the individual to convince their manager (or resign) that problem_A is bad, but problem_B is worse, but not in my P&D objectives.

  The hubris comes from the fact that the CEO doesn't hear the problems that Directors don't disclose.
  The hubris comes from the fact that the Directors don't hear the problems that Senior Managers don't disclose.
  The hubris comes from the fact that the Senior Managers don't hear the problems that Managers don't disclose.
  And Managers simply don't care to hear the problems that Engineers face because "shuddup and close that Jira ticket within 48 hour or else".
I am ~50, I have worked (now..) 20? 20+ years in Audit/Compliance, and I laugh-cry inside.... and I am NOT surprised when I read about cases like this, it's another day in the office/life..

(definitions)

The terms hubris, ate, nemesis, and tisis originated in ancient Greece and had specific meanings and roles in everyday life.

  Hubris
  “Hubris” was a fundamental concept in the lives of the ancient Greeks and was used to describe someone who overestimated their abilities and behaved in an arrogant and offensive manner toward others, toward the laws of the state, but above all toward the gods.
  According to ancient beliefs, such acts of hubris offended and enraged the gods.

  Ate
  “Hubris” consequently provoked the intervention of the gods, and especially Zeus, who sent “ate”—that is, a clouding or blinding of the mind—upon the hubristic person.

  Nemesis
  “Ate” led the hubristic person to commit further acts of hubris, until they committed a grave folly or fell into a very serious error, which provoked “nemesis”—that is, the wrath and vengeance of the gods.

  Tisis
  Next comes “tisis,” that is, the punishment and ruin or destruction of the person who committed hubris.

Re: Leaking YouTube creators' private videos

#187
post #149

Earlier quoted context omitted.

[flagged]

> This is a prime example of why programmers are not seriously considered engineers. Seems to me like your comment is simply an example of prejudice. You're just describing another standardized incentive structure that you're operating in, and using that as a basis to extrapolate that programmers of all kinds—whether they work on a video platform or on machinery that could cause catastrophe if it fails—are implicitly…

The prejudice seems to be everywhere. Unfortunately, to my knowledge.

Eg. architects vs construction engineers vs land surveyors vs construction designers vs urban planners… anyone of them thinks that their profession is more valuable than the others…

Re: Leaking YouTube creators' private videos

#188
post #147

Earlier quoted context omitted.

The web really doesn't, and shouldn't, depend on these things. I use a JavaScript whitelisting tool, so that I can allow JavaScript on pages where it's merited, when the trust for that functionality has been earned. Nowadays it's used for things that have been possible in plain HTML for decades. In this case, text has been added to HTML that causes otherwise visible text not to display, presumably so that it can fade…

If you allowlist javascript then yes your annoyance is tangential, and no it is not interesting for us to read you complain about. Hence why the HN guideline (that was quoted above) exists. (I also allowlist javascript. Regardless of your philosophical standpoint, many websites do break. If you don’t want “smacks me in the face multiple times a day” then stop allowlisting javascript.)

Comments whinging about this are not any more interesting to read either, even if they do not break discussion guidelines themselves.

Use the flag button. This is what it's for.

Re: Leaking YouTube creators' private videos

#189

I recently left Google having worked on a number of projects with various YouTube teams. I think I can explain why it's being handled this way by YouTube. This is a fairly nuanced/involved issue, so the task of classifying the bug likely made it's way to one of the engineers responsible for the implementation of this feature. That engineer has already launched this project, and filed it away under their GRAD (perform…

Glad to hear this is a universal big tech experience. The promo process is entirely antithetical to shipping good products

It depends heavily on your manager and skip. My boss values operations and getting things done (including both doing things right from the beginning, and fixing things when we have to cut corners to launch quickly due to exogenous pressure), and that means people get promoted for being good engineers. Of course this falls apart for higher levels where it is entirely politics, but that is beyond my boss' influence.

Re: Leaking YouTube creators' private videos

#190
The problem is bigger than just something that one engineer can fix, it's a genuine flaw in the training of Gemini, so in order to fix this the model has to be retrained, and new parameters put in place to prevent this kind of thing from happening. The moment a large youtuber gets private content leaked and lands YT in hot water with potential legal liability, and they start talking about what happened, this bug will get fixed. I feel like this is their way of saying the problem is so complex to fix and relatively unknown to most people that they're not going to do anything about it until they have to. The biggest issue is that with the current transformer model they won't even know where to start looking in the Gemini code to fix it, they will literally have to go in and find/ rewrite some random code in the conversational source code which is probably more lines of code than a single engineer can comb though. It would probably take a small team a good amount of time to fix this because you could word it differently and get the same results
Post reply on HN