That's impressive
Leaking the email of any YouTube user for $10k
421–430 of 487 posts
Re: Leaking the email of any YouTube user for $10k
#422Earlier quoted context omitted.
England is just one example of a country of native English speakers who use dd/mm/yyyy.
yyyy-mm-dd is the iso standard, w/ the benefits of logical consistency (larger to smaller units left to right) and -- best of all -- sortability.
The only problem is that it puts the most important information last and the least important first (going by "what do I most likely need to see and cannot infer from context", ie I likely already know the year and possibly the month).
Re: Leaking the email of any YouTube user for $10k
#423Earlier quoted context omitted.
If Google doesn't have the best reputation of any large tech company for security, it's in the top 3. This is not the nightmare scenario for Google that people think it is. It's a large payout for this bug class, so, if anything, what we're doing here is advertising for them.
I'm in all agreement (genuinely thankful for the context you brought on the difference in market values for this category of bugs), which is also part of why it's sobering privacy bugs have such a low valuation and this is set as a high payout. For security researchers it's apparently obvious, but from the outside it's another nail in the coffin of how we want to think about user data (especially creators, many being…
Globally, how many people are there presently salivating at the thought of US$10,000 for a bug bounty?
How many young computer enthusiasts / aspiring security researchers are motivated to learn more because they see, what to them are, massive payouts.
You or I might not get out of bed for the hourly rate that translates to, fine by me - I have a job that pays the figure I negotiated.
Bug bounty programs pay the market clearing rate, always. One bug, two market participants, one price.
Re: Leaking the email of any YouTube user for $10k
#424I found this title confusing. For those who didn't make it toward the end of the article: the leaked emails didn't cost them anything (except their time and ingenuity), and they received 10k as the bug bounty.
From the D/M/Y date format at the end of the article, they may not be native English speakers (at least they aren’t American).
And?
Re: Leaking the email of any YouTube user for $10k
#425Earlier quoted context omitted.
Most other fields of endeavor aren’t compensated based on the black market value of the thing that’s being produced. If we apply your analysis to other things, we’ll find that the upper bound price for a new car stereo or bike is ~ $100, and the price of any copyrighted good is bounded by the cost of transferring it over the network. I think it is more useful to divide the amount Google paid by the number of hours sp…
> Most other fields of endeavor aren’t compensated based on the black market value of the thing that’s being produced. > If we apply your analysis to other things This analysis doesn't work for a few reasons: * For physical goods, used items always fetch a lower price than new items due to unrelated effects. And if we're only looking at the used price, we do find that the black market price is just about equal to the…
> For physical goods, used items always fetch a lower price than new items
This is only true under certain circumstances. If there are supply chain issues, used prices can go up and over the list price. The most extreme (and obvious) example I've seen is home gym equipment during the Covid lockdowns, particularly for stuff like rowing machines.
The other potentially less obvious example is seen in countries that don't have a local presence or distributor for a given item, and the pain and slowness of importing leads to local used prices being above list price.
One other potentially interesting semi-related point: prices for used items can sometimes increase in unexpected ways (excluding obvious stuff like collectables, art, antiques etc). In the UK, the used price for a Nissan Leaf EV started increasing with age after the market realised that fears about their battery failing ~5 years into ownership were unfounded urban myths, and repriced accordingly.
Re: Leaking the email of any YouTube user for $10k
#426Earlier quoted context omitted.
Don't oversell the place. It also has it's down-sides.
Mass shootings, out-of-control police, bankruptcies from for-profit healthcare and expensive medications, Bibles and Creationism in public schools, widespread ignorance about the world and just about everything, and millions (vastly undercounted) of homeless people. But seriously, America is awesome for rich people if you don't mind living in a poor, third-world country that still believes it's a first-world, excepti…
Think you might have missed the parent poster's sarcasm.
Re: Leaking the email of any YouTube user for $10k
#427I found this title confusing. For those who didn't make it toward the end of the article: the leaked emails didn't cost them anything (except their time and ingenuity), and they received 10k as the bug bounty.
I thought they meant providing the services to leak the email of any user for $10K, perhaps per user. :)
That's what I thought too because that's exactly how it's phrased! Terrible wording.
Re: Leaking the email of any YouTube user for $10k
#428> Here's a POC of the exploit in action: This video has been removed for violating YouTube's Terms of Service That's hilarious.
Weird that it shows that to me at first as well, but now when I opened the article again, the video seems to be available? Not sure if it was restored just now.
Maybe just not yet wiped from all CDN caches.
Re: Leaking the email of any YouTube user for $10k
#429Earlier quoted context omitted.
I thought they meant providing the services to leak the email of any user for $10K, perhaps per user. :)
I thought they meant it cost $10K of compute time to brute force some process that would reveal one email address.
Yeah, probably getting an LLM to do it
Re: Leaking the email of any YouTube user for $10k
#430Earlier quoted context omitted.
yyyy-mm-dd is the iso standard, w/ the benefits of logical consistency (larger to smaller units left to right) and -- best of all -- sortability.
The only problem is that it puts the most important information last and the least important first (going by "what do I most likely need to see and cannot infer from context", ie I likely already know the year and possibly the month).
Who cares? How much time are you going to lose from that? Like, 0.15s every time you read a date. Big woop.