doesn't google employ the elite of world programming? how can such stuff even happen? honest question.
Only for the backend.
isn't this backend?
The embedded YouTube player told me what you were watching
21–30 of 112 posts
Re: The embedded YouTube player told me what you were watching
#22That’s why I don’t browse the web while logged in google/fb/twitter.
As I keep them in separated firefox containers
Re: The embedded YouTube player told me what you were watching
#23doesn't google employ the elite of world programming? how can such stuff even happen? honest question.
I've learned to be suspicious of someone's reputation when I don't know what they've done to earn it. Everyone thinks Google employs the best engineers on the planet, but I suspect the reason most people believe that is just that everyone else does. How many people have actually come to believe that because they've done their homework?
Google is an ad company. Their entire business model is based around manipulating public opinion. Don't trust a word you hear about them.
Decide for yourself. Do the products Google makes look like they are made by the best engineers in the world? In my case, the answer is a resounding no.
Re: The embedded YouTube player told me what you were watching
#24$1,337 for watch history + liked videos + watch later disclosure? Requires user to visit a malicious site, yes, but still feels a bit skimpy.
Probably not even worth the time he invested in looking for the bug or writing the post. And is basically nothing compared to the value of "exploiting" this bug.
I would've expected at least a job offer or public praise for his offers. No wonders bug hunting is not attracting enough people.
Re: The embedded YouTube player told me what you were watching
#25EDIT: never mind Should probably be (2019), as the bug has been fixed since (as noted at the bottom of TFA).
AFAICS the article was first posted 18 January 2021, so (2019) would be incorrect.
You’re right of course, I had overlooked the header and misinterpreted the title to refer to the present rather than to the past.
Re: The embedded YouTube player told me what you were watching
#26EDIT: never mind Should probably be (2019), as the bug has been fixed since (as noted at the bottom of TFA).
Every bounty bug write up I've seen on HN was after it had been long fixed, so that should be a given when you see a write up like this.
Re: The embedded YouTube player told me what you were watching
#27doesn't google employ the elite of world programming? how can such stuff even happen? honest question.
> doesn't google employ the elite of world programming?
Yes, some of them. But they are few and far between the tens of thousands of devs now that just glue services together with grpc and protos. The Google that produced cool shit just 7 years ago has grown like 10x in employees. Additionally, any engineer that has stayed that long is a millionaire several times over in stock and is very unlikely bothering with anything as boring as the embedded youtube player.
Google is now IBM 25 years ago or so.
Re: The embedded YouTube player told me what you were watching
#28doesn't google employ the elite of world programming? how can such stuff even happen? honest question.
No, Google employs far too many developers for the median to be close to 'elite'. I'm sure there are elite teams at Google, but I very much doubt the average Googler is, and that's probably been the case for a decade at this point. The famous Rob Pike quote sums it up quite well: > The key point here is our programmers are Googlers, they’re not researchers. They’re typically, fairly young, fresh out of school, probab…
I think Rob Pike's commentary on Go is why I decided to go into research. Google hires kilotons of developers and pays them gigadollars every year, then makes them work in dumbed-down languages because they can't be trusted with power tools.
How has our industry gone so far astray that we pay people hundreds of thousands of dollars a year when they can't even understand generics? In what universe does it make sense to design an entire new language rather than offering new hires two months of training? Why are we pretending programming is a skilled trade when the things people actually wind up doing are so easy they can be learned in three months at a boot camp?
Rob Pike is a legend. He is the man who brought us Plan 9. How is this what he wound up working on?
Re: The embedded YouTube player told me what you were watching
#29That’s why I don’t browse the web while logged in google/fb/twitter. As I keep them in separated firefox containers
It's not about you, it's about your parents and grandparents.
Re: The embedded YouTube player told me what you were watching
#30doesn't google employ the elite of world programming? how can such stuff even happen? honest question.
This seems something trivial to miss. The developer is asked to put the player into a page that has basically just the player and exposes and API. The API should allow playing videos and playlists. They do the obvious thing and it all works.
The fact is that the security here wasn't the default. They need to explicitly realize that this allows the website to list playlists and consider that this should not allow listing the playlist with the user's credentials.
This seems like an incredibly likely vulnerability to me and I am not surprised that even "elite" programmers missed it.