Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Leaking YouTube creators' private videos

javoriuski.com

Post reply on HN
Print view View original

361–370 of 436 posts

Re: Leaking YouTube creators' private videos

#361

Post by justinclift »

NamTaf wrote: post #149
Mg6yDfjp5U wrote: post #10

I recently left Google having worked on a number of projects with various YouTube teams. I think I can explain why it's being handled this way by YouTube. This is a fairly nuanced/involved issue, so the task of classifying the bug likely made it's way to one of the engineers responsible for the implementation of this feature. That engineer has already launched this project, and filed it away under their GRAD (perform…

[flagged]

> This is a prime example of why programmers are not seriously considered engineers.

Alternatively, perhaps Google has a culture problem where it encourages crap like this?

Re: Leaking YouTube creators' private videos

#362

Post by eldaisfish »

m00x wrote: post #166
fathermarz wrote: post #157

Earlier quoted context omitted.

I think there is a fine line. YouTube is not critical software and no one’s life depends on the safety (putting mental health aside) of the code running. Some software engineers do however write code that is critical, but to your point, I don’t think they are ever considered liable. I went through an acquisition as a Canadian software developer getting acquired by an American company. They wanted us to be called engi…

Youtube should consider their engineers responsible for the software they write. Big companies these days are just bureaucracy tricks and politics. There's a small handful of real talent, but they're quickly moving to new startups. Also, I'm Canadian as well, and almost everyone calls themselves "software engineer" these days. You just can't say P.eng. in your title. You could be forced to remove it from linkedin/etc…

Your latter point is legally incorrect. The protected term in Canada is “engineer”. If someone calls themselves an engineer without a P.Eng, that’s an offence.

Re: Leaking YouTube creators' private videos

#363

Post by tambre »

CMay wrote: post #156

In the example provided of leaking a private video, you already need access to the private video to even comment on it. That scenario is not much of an exploit. Unless there's a better example of what can be abused, the more realistic concern is authority laundering where a command tricks YouTube into giving the user instructions that sound like they're coming from Google. Another risk is using it to get the AI to mi…

Access to the private video doesn't sound necessary. The AI seemingly runs in a context where it sees the private videos so comments on public videos can instruct it to generate links containing such info.

Re: Leaking YouTube creators' private videos

#364

Post by classified »

miki123211 wrote: post #350
NamTaf wrote: post #149

Earlier quoted context omitted.

[flagged]

Software engineers have a widely-shared belief that most software issues are far less severe than those found in civil engineering. Even a security breach — arguably the worst issue there is — rarely results in any meaningful consequences for those whose data has been breached. I don't think this belief is entirely justified, but as programmers, it's really hard to predict when our actions suddenly become life-threat…

> at a data analytics company

So it wasn't even anything related to the app's purpose, it was a frivolous surveillance SDK that got people killed.

Re: Leaking YouTube creators' private videos

#365

Post by classified »

numpad0 wrote: post #346
term333 wrote: post #209

Earlier quoted context omitted.

I think the general hacker culture of most programmers prevents this. There's an undercurrent of anti-establishment, anti-authority, anti-management, etc... To think that the industry might choose to self enforce a license system seems very unlikely.

I think another reason this hasn't happened is sheer complexity of the modern software stack. No one fully understand how everything works, in principle or in details. You can't certify someone or establish principles for things no one understands anything about.

That's just laziness. Analog systems are even messier, but they have procedures and regulations that keep the catastrophes to a minimum.

Re: Leaking YouTube creators' private videos

#366

Post by maccard »

chirau wrote: post #305
nwallin wrote: post #279

Earlier quoted context omitted.

> Honestly it’s hard to refute the fact that we need roads and houses more than we need cat videos. If the software made by my company ceased to exist, every government in the US, federal, state, and municipal, every construction company, plus most governments worldwide would be unable to build roads or houses until they were able to cobble together a replacement. The entire world runs on software. Software controls…

As a 'software engineer' myself, I fully understand your position, but please qualify the statement about the software you work on. Either add 'efficiently' or 'at scale', because all that infrastructure you mentioned could definitely be built without your software. It was possible before your software and it sure would be possible without it, it just would not be as easy. I am sure someone is going to dwell on that…

This is silly. People survived before the Haber Bosch process but an overnight removal of it from the world would absolutely result in a catastrophic collapse.

If you want to be reductive, we’re all going to die due to entropy anyway, it will all balance out so there’s no point in doing anything at all.

Re: Leaking YouTube creators' private videos

#367

Post by BetterThanSober »

thx67 wrote: post #336
BetterThanSober wrote: post #202

Earlier quoted context omitted.

Google definitely doesn't have free egress

Google owns the backbone. They definitely have free egress.

(1) There is no single entity called "the backbone." (2) Yes, they do direct peering with ISPs whenever possible, but maintaining on-premise cache AND the "backbone" is not a trivial matter, nor free

They're paying a marginal cost compared to us plebs, yeah, but definitely not "free", especially when YT is allegedly responsible for 1/6th of global internet traffic

Re: Leaking YouTube creators' private videos

#368

Post by chii »

zelphirkalt wrote: post #357
NamTaf wrote: post #149

Earlier quoted context omitted.

[flagged]

That's why trains work, but Google's shitty YouTube often does not: Terrible, terrible video player, tons of crap on the page, broken buffering all the time, huge memory and CPU hog, need to log in to even watch a video if using a VPN, insane key bindings that are switched around depending on full screen mode or not, stupid and manipulative ads that only the uninformed or simple minded can tolerate, and the list goes…

> That's why trains work

and that's why trains work but you have to pay a higher price to use it, while youtube is shitty, and breaks often, but it's free to use.

It is about the trade offs - not the trade offs that someone talks about passively, but actual action based trade offs; ala voting with their feet.

Re: Leaking YouTube creators' private videos

#369

Post by chii »

syl5x wrote: post #184

Welp, I reported a lot of AI prompt-injection bugs to various organizations, even some leading to RCE. They would say that they won't consider it as a bug, silently fix it and you are left there doing the work for free. I won't say "do not report stuff" but what's the point when companies are treating people like that, the incentive of finding and reporting bugs is literally zero nowadays.

> They would say that they won't consider it as a bug, silently fix it and you are left there doing the work for free.

then as long as you have a trail that proves you discovered and reported it, you can make this a PR nightmare for them with noise about it publicly. The fact that it is fixed means it is considered an issue, and so by declining to acknowledge the issue and refusing to pay, they're essentially deleting the built-up trust of a bug bounty.

It won't pay out even if you did this of course, but if this happens a lot, the aggregate reputational damage leads to "do not report". That's really the only outcome you can engineer, but it is decently damaging that google _should_ see and prevent it.

Re: Leaking YouTube creators' private videos

#370

Post by chii »

tyrust wrote: post #167

Why doesn't the article contain proof of either attack in action? I would be surprised if the second attack worked after what must be at least a couple layers of markdown/html conversion and spam filtering. disclaimer: work at Google, but far removed from YouTube

The attack requires a third party to unknowingly click on the engineered URL that leak private video title. Not sure if it counts as a POC if you can only use your own channel to prove it works.

But still, it would require a user interaction to click on the link to leak data - and google should acknowledge it as an issue, because an attacker should never be able to generate a link they control in a trusted/secure environment.

Post reply on HN