Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SmartTube Compromised

aftvnews.com

Post reply on HN
Print view View original

111–120 of 155 posts

Re: SmartTube Compromised

#111

Post by aix1 »

rdsubhas wrote: post #72
GaryBluto wrote: post #6

It's kind of shocking to me that so many people would download an app like this and sign in using their actual YouTube account.

Google Account. Not Youtube account.

Technically correct but somewhat misleading. The app in question only asked for the following Google account permissions:

   1. Manage your YouTube account
      View and manage your videos and playlists
      View and manage your YouTube activity, including posting public comments
   2. View and manage your [YouTube] rental and purchase history
      Your rental and purchase history may be displayed and accessible on this device.

Re: SmartTube Compromised

#112

Post by jfindper »

dottjt wrote: post #30
M4v3R wrote: post #12

Earlier quoted context omitted.

Is $14 dollars for ad-free, unlimited access to literally billions of videos really a steep price? Personally if I were to get rid of all but one of my media subscriptions I would stick with this one, since it's got everything - entertainment, education, inspiration, you name it.

When the alternative is the exact same thing you describe but for $0 dollars, then yes.

For sure! $0.00*

* $0.00 plus additional risk that the author of the alternative you are using is compromised, you end up using a malicious version of that alternative, and get pwned.

Obviously for some/many, that trade-off is totally cool. But it needs to be included in the analysis, otherwise you're being dishonest.

Re: SmartTube Compromised

#113

Post by hollerith »

carlosjobim wrote: post #71
graemep wrote: post #38

Earlier quoted context omitted.

I am not going to watch billions of Videos. Its not entirely ad free, just fewer ads, AFAIK sponsored segments remain so there are still ads, sometimes quite lengthy ones. $14/month is $168 an year, and if you subscribe to multiple other video services the annual total is going to be quite high.

YouTube is 10x the quality and 10x the quantity than any other video service. As for the ads, YouTube Premium now has built-in sponsor skip. They can't really block sponsored segments, as that is a freedom of speech issue and also something they can't easily determine. Creators can just omit that some product is sponsored.

>Creators can just omit that some product is sponsored.

Not true in the US, where the FTC requires (and has required for decades) disclosure by the creator to the viewer whenever a payment has been made to the creator to promote anything. On Youtube, this is typically done by the creator's saying (in the video) "this video is sponsored by Foo Corporation", or, "I wish to thank the sponsor of this video, Foo Corporation".

Personally, I'm unhappy with Premium's built-in sponsor skip. For one thing it becomes available to me only after enough previous viewers have manually skipped over the sponsored segment. For another, it sometime skips ahead too far (probably because the viewers who manually skipped weren't precise in skipping exactly to the end of the sponsored segment). I'd much rather Youtube allowed the uploader to declare (to Youtube) that the upload is free of sponsors (e.g., by checking a box) and then punishing the uploader somehow if he routinely declares falsely. With that information, Youtube could and IMHO should give me the option of telling Youtube somehow (e.g., by checking a box) that I prefer for sponsored videos to be omitted from my recommendations.

Re: SmartTube Compromised

#114

Post by hansvm »

jeffbee wrote: post #92
hansvm wrote: post #80

Earlier quoted context omitted.

It's >12x the ad revenue they bring in per monthly-active YouTube user (suggesting they'd still be happy with a much lower price), and the price has increased 75% in the last decade (compared to the 40% real inflation over that period, suggesting they intend to continue increasing the price till public backlash or other effects reduce their total revenue). Plus they're boiling the frog, slowly adding ads back in to m…

> the price has increased 75% in the last decade It launched at $9.99[1] and is now $13.99[2] which I believe to be a 40% increase, i.e. flat in real dollars. If like most people you subscribe for a year, it's only $11.67/mo. 1: https://www.cnet.com/tech/services-and-software/youtube-free... 2: https://www.youtube.com/premium

I was going off the 7.99/mo price I first paid (which they've recently stopped grandfathering in). Was that not a common amount people paid?

Re: SmartTube Compromised

#115

Post by a2128 »

HackerThemAll wrote: post #96
boje wrote: post #23

I really hope Google doesn't pick this out (and similar events) as further justification for getting rid of APK-based installation.

Blocking file-based installations was never planned. It's fake news and always has been. It's all about requiring code signing for all code so that malware-spreading authors can be easily blocked by adding their signing key fingerprint to the blocklist. It doesn't matter whether the app is installed via Play Store, Huawei's or Samsung's store etc., or from APK.

This is a drastic misrepresentation of the situation. All Android apps already have code signing, you cannot install an app unless it has a signature, and any future updates are blocked unless the signature matches. This is how it's been practically since the start of Android, it's part of the security model to prevent something like a malicious Firefox APK stealing your cookies.

What's new is that they were gonna block installations outside of Google Play, unless the developer has signed up for Google Play Console and has gone through a verification process there, whitelisting their signing key fingerprint. However, they've walked back on this and said they'll create a new "advanced flow" for "advanced users" that's "designed to resist coercion" to bypass this restriction. Door in the face technique IMO, the existing 12-step process to installing an app was already complicated enough.

So effectively the result is that file based installations will be blocked unless Google has specifically whitelisted their key through the Google Play Console verification process, or the user goes through this "advanced flow" which we're yet to see any details of

Re: SmartTube Compromised

#116

Post by drewg123 »

GaryBluto wrote: post #6

It's kind of shocking to me that so many people would download an app like this and sign in using their actual YouTube account.

It has a far better user interface than the official YT interface. And that interface can be heavily customized to your exact preferences.

My wife has YT Premium, and we find ourselves watching YT in SmartTube just because the interface is so much better.

Re: SmartTube Compromised

#117

Post by bigyabai »

M4v3R wrote: post #12
dottjt wrote: post #8

Earlier quoted context omitted.

I think it's more shocking to people how much YouTube Premium costs.

Is $14 dollars for ad-free, unlimited access to literally billions of videos really a steep price? Personally if I were to get rid of all but one of my media subscriptions I would stick with this one, since it's got everything - entertainment, education, inspiration, you name it.

Thanks for paying $14/month to support my ad-free yt-dlp archive, shmuck.

Re: SmartTube Compromised

#118

Post by cyberax »

Groxx wrote: post #110
cyberax wrote: post #107

Earlier quoted context omitted.

I have YT Premium that pays much more than sponsors. That's also why I just use Firefox instead of third party apps to watch YT.

essentially every YouTuber I've watched who discussed their financials said that their sponsorships brought in several times more money than all forms of YouTube money. which is a very niche slice, and I have no idea how representative it is in aggregate. but sponsorships happen because they pay well enough to annoy every viewer, not just ones that aren't using the better-paying Premium - they generally are not cheap…

Linus Tech Tips disclosed their finances: https://www.reddit.com/r/LinusTechTips/comments/1jjplow/ltt_... - and their sponsorships are less than the YT ads income.

If you look at Premium, it's about 100x more lucrative than regular views. So I'm pretty sure I'm providing more money to creators than the skipped ads.

Re: SmartTube Compromised

#119

Post by jeffbee »

hansvm wrote: post #114
jeffbee wrote: post #92

Earlier quoted context omitted.

> the price has increased 75% in the last decade It launched at $9.99[1] and is now $13.99[2] which I believe to be a 40% increase, i.e. flat in real dollars. If like most people you subscribe for a year, it's only $11.67/mo. 1: https://www.cnet.com/tech/services-and-software/youtube-free... 2: https://www.youtube.com/premium

I was going off the 7.99/mo price I first paid (which they've recently stopped grandfathering in). Was that not a common amount people paid?

This suggests that you initially subscribed to Google Play Music at their launch special price, and were later grandfathered into getting YouTube Premium at the same price, or that you used YouTube Music Key (yes, more product roadmap confusion!) with the same outcome, or that you signed up with a student account (this is still $7.99 today).

Re: SmartTube Compromised

#120

Post by Klaus23 »

ninalanyon wrote: post #83
Klaus23 wrote: post #66

A lot of people installed malware and, to be honest, nothing really happened. They might have had to change their passwords, but it could have been much much worse if Android didn't have good sandboxing. I hope that Flatpak and similar technologies are adopted more widely on desktop computers. With such security technology existing, giving every application full access to the system is no longer appropriate.

Why do you need Flatpak for sandboxing? I really dislike Flatpak for installing multiple identical copies of the dependencies. Just give me some easier to use tools to configure the access that each application has.

> Why do you need Flatpak for sandboxing?

You don't, but as far as I know, Flatpak or Snap are the only practical, low-effort ways to do it on standard distros. There's nothing stopping flatpak-like security from being combined with traditional package management and shared libraries. Perhaps we will see this in the future, but I don't see much activity in this area at the moment.

Post reply on HN