Live data from Hacker News

SmartTube Compromised

aftvnews.com

81–90 of 155 posts

Re: SmartTube Compromised

#81

It's kind of shocking to me that so many people would download an app like this and sign in using their actual YouTube account.

Sometimes people download it because there's no alternative. E.g. the YT app is not available in the play store in their country on that specific hardware, so the only way to be able to view YT is to use an alternative app like this one.

> the only way to be able to view YT

Surely you can use a web browser?

Re: SmartTube Compromised

#82
post #10

In an article about not downloading malware: "You can use my downloader! It's totally safe, bro!" Yeah, I'll pass.

The internal auto updater of the app directly use github as source, was this also compromised ? If malware was only on some random apkmirror upload then it should probably be fine for most users.

Apparently, yes. My guess is it was the Shai-hulud npm malware leaking their Github keys.

Re: SmartTube Compromised

#83
post #66

A lot of people installed malware and, to be honest, nothing really happened. They might have had to change their passwords, but it could have been much much worse if Android didn't have good sandboxing. I hope that Flatpak and similar technologies are adopted more widely on desktop computers. With such security technology existing, giving every application full access to the system is no longer appropriate.

Why do you need Flatpak for sandboxing?

I really dislike Flatpak for installing multiple identical copies of the dependencies.

Just give me some easier to use tools to configure the access that each application has.

Re: SmartTube Compromised

#84
> SmartTube’s developer told me that the computer used to create the APKs for the project’s official GitHub page was compromised by malware. As a result, some official SmartTube releases were unintentionally released with malware.

Seems it's lacking in information about how a malware manages to compromise supposedly signed releases? Do authors not have the production signing keys behind a password or similar, and review 100% of the changes before they deploy stuff?

I swear the more time goes on, the more I'm loosing faith in the entire ecosystem. People running random binaries on the same device they do banking on always surprised me, but now developers manages to get malware on their developer machine and are publishing random binaries to other strangers???

Re: SmartTube Compromised

#85

Earlier quoted context omitted.

$14 is two days worth of living in my country for your average man on the street, among many other similar places. Imagine if you had to pay $200 to watch YouTube, that's how much these services cost for us. They refuse to correct for purchasing power parity and are left with nothing in the end. Steam seems to do very well in comparison. (I don't watch YouTube even for free, but practically everybody I know does with…

There are a lot of things in this world besides YouTube Premium, which cost $14 or more. That some people in the world are very poor is no kind of argument as to how companies should price their products. "Purchasing power parity" is a non-concept for almost 100% of companies and products. But YouTube Premium is priced differently in different regions. Sometimes much cheaper than $14.

The person you're responding to is not debating that the companies are setting the wrong prices, so no need to try to convince them that the companies are already setting prices "the right way".

They're explaining for people who don't seem to understand, why people are fine signing in to these kind of 3rd party apps in the first place, because the subscription price ends up being what these people earn in days, not hours.

Re: SmartTube Compromised

#86

Earlier quoted context omitted.

Sometimes people download it because there's no alternative. E.g. the YT app is not available in the play store in their country on that specific hardware, so the only way to be able to view YT is to use an alternative app like this one.

> the only way to be able to view YT Surely you can use a web browser?

The user experience accessing YouTube through a web browser on a TV (the main target audience for SmartTube) is less than ideal.

TV and set-top box browsers tend to be slow and fiddly to use from a TV remote. (And often running on underpowered hardware).

Re: SmartTube Compromised

#87
post #38

Earlier quoted context omitted.

I am not going to watch billions of Videos. Its not entirely ad free, just fewer ads, AFAIK sponsored segments remain so there are still ads, sometimes quite lengthy ones. $14/month is $168 an year, and if you subscribe to multiple other video services the annual total is going to be quite high.

YouTube is 10x the quality and 10x the quantity than any other video service. As for the ads, YouTube Premium now has built-in sponsor skip. They can't really block sponsored segments, as that is a freedom of speech issue and also something they can't easily determine. Creators can just omit that some product is sponsored.

> YouTube is 10x the quality and 10x the quantity than any other video service.

I guess you could say YouTube surfaces a larger span of quality, from really shit quality to incredible high quality, which I guess is cool. But since they provide zero tools to actually discover the really high quality, and on top of that decide they know better what I want to watch than me (like the subscriptions page not starting with the last published video), does that really matter?

> as that is a freedom of speech issue

It isn't. Freedom of speech in the US (since Google is based there, and maybe you too?) is about the government placing restrictions, not companies or individuals. As a individual (or company), you're free to limit the speech of anyone who want on your platform, for any reason. You might face public outcry, but it isn't a freedom of speech issue as it's on a private platform in the first place.

Re: SmartTube Compromised

#88

> SmartTube’s developer told me that the computer used to create the APKs for the project’s official GitHub page was compromised by malware. As a result, some official SmartTube releases were unintentionally released with malware. Seems it's lacking in information about how a malware manages to compromise supposedly signed releases? Do authors not have the production signing keys behind a password or similar, and rev…

the malware need not actively create a release like a worm, it can just infect every build and if you don't check carefully, your next regular release will contain it.

Re: SmartTube Compromised

#89
post #80
post #12

Earlier quoted context omitted.

Is $14 dollars for ad-free, unlimited access to literally billions of videos really a steep price? Personally if I were to get rid of all but one of my media subscriptions I would stick with this one, since it's got everything - entertainment, education, inspiration, you name it.

It's >12x the ad revenue they bring in per monthly-active YouTube user (suggesting they'd still be happy with a much lower price), and the price has increased 75% in the last decade (compared to the 40% real inflation over that period, suggesting they intend to continue increasing the price till public backlash or other effects reduce their total revenue). Plus they're boiling the frog, slowly adding ads back in to m…

> Plus they're boiling the frog, slowly adding ads back in to music and shorts for premium users

Do you have a source for this?

I do value watching unlimited youtube videos without ads, but if they're gonna add the ads back in, I'd easily stop paying for the one google product I currently pay for (and honestly the only reason I haven't already done this is laziness and convenience)

Re: SmartTube Compromised

#90

Earlier quoted context omitted.

Not to mention included YouTube Music. It's one of the few subs I pay for, because I watch a _lot_ of YouTube on the TV. And also like to have it in the background for "Podcast" style videos where the video is really only an accompaniment.

That's actually worse. They used to have a separate YouTube subscription. I don't want (to pay for) YouTube Music, because I already have Apple Music and Tidal, which I prefer.

This is not accurate. The entire time that YouTube Premium (Red) existed, a subscription to it always included the music service.
Post reply on HN