Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The embedded YouTube player told me what you were watching

bugs.xdavidhu.me

Post reply on HN
Print view View original

91–100 of 112 posts

Re: The embedded YouTube player told me what you were watching

#91

Post by SR2Z »

stretchcat wrote: post #60
anonymousab wrote: post #36

Earlier quoted context omitted.

Professionals with many years of experience could and would still make mistakes with C and C++. And many mistakes are very costly at Google's scale. Wanting to make the situation better through a simpler, safer fit-for-purpose tool doesn't mean an industry is flawed anymore than the prevalence of sawstops means that carpentry is flawed.

Holy spin. Rob Pike was explicitly talking about young inexperienced programmers who are 'not capable of understanding a brilliant language.' He wasn't talking about experienced developers and made that as clear as he possibly could. Go is made simple for novices, not safe for veterans.

You don't really get a choice when you decide you're going to write a project in a language. Senior devs will be required to work in the same language as the junior devs.

Re: The embedded YouTube player told me what you were watching

#92

Post by pcthrowaway »

akanet wrote: post #70
pcthrowaway wrote: post #67

I honestly feel like Google's award in this case is pathetic. This is an exploit which would be worth 100s of thousands, if not millions to the wrong people.

There is no entity that would pay anywhere near that amount of money for this. This is useless to black hats, and of course no legitimate service could pay to exploit this flaw. The last remotely plausible actor is like, various espionage agencies but good luck with that one.

I suspect the NSA would be able to keep much better tabs on people if they know exactly what they're watching on Youtube all the time, and $100,000 would be a pittance to them. I assume they already have access to this, but other espionage agencies may not.

Re: The embedded YouTube player told me what you were watching

#93

Post by iratewizard »

rapind wrote: post #58
taldo wrote: post #8

$1,337 for watch history + liked videos + watch later disclosure? Requires user to visit a malicious site, yes, but still feels a bit skimpy.

Bug bounties are ridiculous. If you disclose in an “irresponsible” way you’d get shamed here on HN, and yet we almost never talk about how pitiful the rewards are for “responsible” disclosure (maybe nothing or even legal trouble!).

> yet we almost never talk about how pitiful the rewards are

We almost always talk about how pitiful the rewards are, every time someone discloses a pitiful reward. Your post is doing exactly that.

Re: The embedded YouTube player told me what you were watching

#94

Post by xvector »

rapind wrote: post #58
taldo wrote: post #8

$1,337 for watch history + liked videos + watch later disclosure? Requires user to visit a malicious site, yes, but still feels a bit skimpy.

Bug bounties are ridiculous. If you disclose in an “irresponsible” way you’d get shamed here on HN, and yet we almost never talk about how pitiful the rewards are for “responsible” disclosure (maybe nothing or even legal trouble!).

Honestly, I’m all for irresponsible disclosure if corporations pay irresponsibly low bounties.

We need to disabuse corporations of the idea that they deserve responsible disclosure when they pay paltry sums for serious bugs.

Re: The embedded YouTube player told me what you were watching

#95

Post by davidmurdoch »

taldo wrote: post #8

$1,337 for watch history + liked videos + watch later disclosure? Requires user to visit a malicious site, yes, but still feels a bit skimpy.

Reminds me of when Google awarded me a whole Nexus 7 tablet for finding a way to run external JavaScript inside of Gmail for Android. The exploit required the user to tap on the email after opening it, which is why it didn't qualify for any money.

Re: The embedded YouTube player told me what you were watching

#96

Post by reificator »

reificator wrote: post #86
anonymousab wrote: post #36

Earlier quoted context omitted.

Professionals with many years of experience could and would still make mistakes with C and C++. And many mistakes are very costly at Google's scale. Wanting to make the situation better through a simpler, safer fit-for-purpose tool doesn't mean an industry is flawed anymore than the prevalence of sawstops means that carpentry is flawed.

> a simpler, safer fit-for-purpose tool Generics nothing more or less than a safety feature. Right now code that would use generics instead use the empty interface instead, which is effectively opting out of the type system entirely. I'm personally ambivalent on whether go adds generics or not but framing a lack of generics as a safety feature is the most absurd thing I've heard today.

Wow came back to this and my grammar was horrible. Looks like I typed it out, edited, and failed to double check my edits...

Re: The embedded YouTube player told me what you were watching

#97

Post by kortilla »

pizza_shit wrote: post #90
kortilla wrote: post #27

Earlier quoted context omitted.

> doesn't google employ the elite of world programming? Yes, some of them. But they are few and far between the tens of thousands of devs now that just glue services together with grpc and protos. The Google that produced cool shit just 7 years ago has grown like 10x in employees. Additionally, any engineer that has stayed that long is a millionaire several times over in stock and is very unlikely bothering with anyt…

No it’s not. Did you completely miss the memo on google duplex, tensorflow, kubernetes, etc? G is still way more technologically advanced than any other top tech company, and is currently positioned at the top of the AI research ladder in many (if not all) sub disciplines

Yeah, you’ve just described IBM 25 years ago. Lots of pockets of innovation in a sea of mediocrity. It wasn’t even that long ago that IBM was considered a top 5 company in cloud, AI, and quantum computing.

> G is still way more technologically advanced than any other top tech company

That’s a senseless statement. Google has lots of nice tooling for developers and managing their infrastructure, but that doesn’t make them the most “technologically advanced”. They use a mono-repo for a ton of stuff, most shit is boring grpc calls and regular database lookups. There is nothing on the leading edge of the crypto/blockchain world, there isn’t anything particularly interesting in p2p, etc.

> Did you completely miss the memo on google duplex, tensorflow, kubernetes, etc?

It’s funny you should mention kubernetes since most of the innovation there comes from outside of Google. Look at who is driving ebpf networking adoption, etc.

You’re right though that Google is currently an AI leader. But again, that’s <1% of their engineering workforce. When I left a few years back most people were working on simple shit resting and vesting. It’s an incredible place to retire in place, but that will eventually catch up with them and it’s bad for career development as a SWE.

Re: The embedded YouTube player told me what you were watching

#99

Post by remus »

verganileonardo wrote: post #24
taldo wrote: post #8

$1,337 for watch history + liked videos + watch later disclosure? Requires user to visit a malicious site, yes, but still feels a bit skimpy.

Probably not even worth the time he invested in looking for the bug or writing the post. And is basically nothing compared to the value of "exploiting" this bug. I would've expected at least a job offer or public praise for his offers. No wonders bug hunting is not attracting enough people.

> And is basically nothing compared to the value of "exploiting" this bug.

Out of interest, how do you think you'd go about monetising this bug?

I agree that the information leakage is definitely bad, but exploiting that to turn it in to cold hard cash seems tricky at best imo. I presume this factors in to Google's payout calculations.

Re: The embedded YouTube player told me what you were watching

#100

Post by GoblinSlayer »

gverrilla wrote: post #21
GoblinSlayer wrote: post #20

Earlier quoted context omitted.

Only for the backend.

isn't this backend?

Looks like frontend:

>Thankfully, YouTube has a solution for this as well, the YouTube Player API. This API allows you to just add a JS library to your site, and then simply create/modify/control the YouTube players on your site however you’d like, using JavaScript. For example, if you want to pause a video, you can just call player.pauseVideo().

Post reply on HN