[HN Gopher] The embedded YouTube player told me what you were wa...
___________________________________________________________________
The embedded YouTube player told me what you were watching
Author : hackerpain
Score : 157 points
Date : 2021-01-18 16:02 UTC (6 hours ago)
(HTM) web link (bugs.xdavidhu.me)
(TXT) w3m dump (bugs.xdavidhu.me)
| taldo wrote:
| $1,337 for watch history + liked videos + watch later disclosure?
| Requires user to visit a malicious site, yes, but still feels a
| bit skimpy.
| underwater wrote:
| That's barely worthy the time to create a proof of concept and
| write up the bug, let alone all the time spent understanding
| and finding it in the first place. A full time engineer costs
| Google more than that each day.
| Lorin wrote:
| Agreed, as an example this could have been exploited by leak
| sites to get unlisted videos prior to public
| announcements/launches.
| sbarre wrote:
| > Requires user to visit a malicious site
|
| YouTube embeds are such universal things on the web, I doubt
| anyone would even think twice about security concerns coming
| from seeing that on a third-party site.
|
| Because it's Google, right? /s
| Nextgrid wrote:
| Do you actually need to see it? The exploit should work fine
| even if the player is not visible.
| satya71 wrote:
| Strangely, I almost never allow YouTube embeds (or for that
| matter any embeds) using uMatrix. I click the pop out link
| that appears in its place.
| rapind wrote:
| Bug bounties are ridiculous. If you disclose in an
| "irresponsible" way you'd get shamed here on HN, and yet we
| almost never talk about how pitiful the rewards are for
| "responsible" disclosure (maybe nothing or even legal
| trouble!).
| SquareWheel wrote:
| The bounties can actually be rather good. This one just seems
| disproportionately low.
| verganileonardo wrote:
| Probably not even worth the time he invested in looking for the
| bug or writing the post. And is basically nothing compared to
| the value of "exploiting" this bug.
|
| I would've expected at least a job offer or public praise for
| his offers. No wonders bug hunting is not attracting enough
| people.
| layer8 wrote:
| EDIT: never mind
|
| Should probably be (2019), as the bug has been fixed since (as
| noted at the bottom of TFA).
| ehsankia wrote:
| Every bounty bug write up I've seen on HN was after it had been
| long fixed, so that should be a given when you see a write up
| like this.
| layer8 wrote:
| I misinterpreted the "2019, October 11, 00:16" to indicate
| when the following text was written.
| warp wrote:
| AFAICS the article was first posted 18 January 2021, so (2019)
| would be incorrect.
| layer8 wrote:
| You're right of course, I had overlooked the header and
| misinterpreted the title to refer to the present rather than
| to the past.
| kkotak wrote:
| He lost me at - Forgot to eat Pizza.
| grishka wrote:
| Yet another example of why the whole concept of third-party
| cookies does much more evil than good. Yet all major browsers
| keep them enabled by default.
| pcthrowaway wrote:
| I honestly feel like Google's award in this case is pathetic.
| This is an exploit which would be worth 100s of thousands, if not
| millions to the wrong people.
| akanet wrote:
| There is no entity that would pay anywhere near that amount of
| money for this. This is useless to black hats, and of course no
| legitimate service could pay to exploit this flaw. The last
| remotely plausible actor is like, various espionage agencies
| but good luck with that one.
| djrogers wrote:
| This is a bad link, not sure how it got upvoted when following it
| fails (there's a trailing . after the domain). That's kinda
| fishy...
|
| Correct link should be
| https://bugs.xdavidhu.me/google/2021/01/18/the-embedded-yout...
| noman-land wrote:
| Adding the dot after the tld actually works on some sites to
| bypass paywalls.
| cuspycode wrote:
| And in the old days people were accustomed to be able to
| resolve local hostnames, without having to supply any domain
| part. The "search" keyword in resolv.conf is a remnant of
| this. By adding a final dot, you ensured that the domain part
| you wrote referred to the global DNS root, not any local one.
| Unless of course someone had changed "ndots" which controls
| how many dots are needed to disable the search feature.
| joshuaissac wrote:
| It works for me, and having a dot after the TLD is perfectly
| valid.[1]
|
| 1. Page 7 of RFC 1034 https://www.ietf.org/rfc/rfc1034.txt
| heinrich5991 wrote:
| Interestingly enough, I can follow it without any errors.
|
| Firefox 84.0 on Arch Linux.
| kahrl wrote:
| Working in Mozilla, Edge, Chrome 87....
| leothecool wrote:
| The trailing dot is fine.
|
| http://www.dns-sd.org/trailingdotsindomainnames.html
|
| Though now I'm curious why it fails for you.
| warp wrote:
| Fails in Safari for me. Works fine in Firefox and Chrome on
| the same machine.
| oauea wrote:
| Sounds like a bug in Safari.
| anonymousiam wrote:
| I can see why Google might want to downplay this. Partner
| websites could obtain the history info directly from users and
| Google would not need to disclose the data sharing. I'm sure the
| watchlists/history would be valuable tools for profiling and
| advertising purposes.
| gverrilla wrote:
| doesn't google employ the elite of world programming? how can
| such stuff even happen? honest question.
| jakearmitage wrote:
| I don't know, but they can solve binary trees on a whiteboard
| really fast.
| Jaygles wrote:
| Probably due to the scale they're operating at. Maybe there
| were parts of things that didn't have such a vulnerability
| alone but did when put together. Maybe there isn't a clear
| owner of the code so no one felt responsible to find and patch
| such a thing. Maybe the entire system is too complex for one or
| even a small team of developers to grok so things can easily
| slip through the cracks from time to time.
| kortilla wrote:
| > doesn't google employ the elite of world programming?
|
| Yes, some of them. But they are few and far between the tens of
| thousands of devs now that just glue services together with
| grpc and protos. The Google that produced cool shit just 7
| years ago has grown like 10x in employees. Additionally, any
| engineer that has stayed that long is a millionaire several
| times over in stock and is very unlikely bothering with
| anything as boring as the embedded youtube player.
|
| Google is now IBM 25 years ago or so.
| bidirectional wrote:
| No, Google employs far too many developers for the median to be
| close to 'elite'. I'm sure there are elite teams at Google, but
| I very much doubt the average Googler is, and that's probably
| been the case for a decade at this point. The famous Rob Pike
| quote sums it up quite well:
|
| > The key point here is our programmers are Googlers, they're
| not researchers. They're typically, fairly young, fresh out of
| school, probably learned Java, maybe learned C or C++, probably
| learned Python. They're not capable of understanding a
| brilliant language but we want to use them to build good
| software.
| xirbeosbwo1234 wrote:
| I think Rob Pike's commentary on Go is why I decided to go
| into research. Google hires kilotons of developers and pays
| them gigadollars every year, then makes them work in dumbed-
| down languages because they can't be trusted with power
| tools.
|
| How has our industry gone so far astray that we pay people
| hundreds of thousands of dollars a year when they can't even
| understand generics? In what universe does it make sense to
| design an entire new language rather than offering new hires
| two months of training? Why are we pretending programming is
| a skilled trade when the things people actually wind up doing
| are so easy they can be learned in three months at a boot
| camp?
|
| Rob Pike is a legend. He is the man who brought us Plan 9.
| How is _this_ what he wound up working on?
| eternalsculptor wrote:
| >can't understand generics
|
| Is this really true? We learned about generics in college
| so I assumed that everyone knew it (especially if they work
| at Google).
| sascha_sl wrote:
| OP is taking a swing at Go's lack of generics.
|
| Just because a language focuses on simplicity does not
| automatically make it bad. People use Go to solve complex
| issues, so it makes total sense none of that working
| memory should be occupied with understanding language
| features, even if they're as simple as generics.
|
| A more extreme way to write Go is "space shuttle style"
| Code, as used in the Kubernetes Volume Controller, a
| radically different approach to "I want all my complex
| features that I can use to shoot myself in the foot".
|
| You might be able to handle a firearm, but we have plenty
| of injuries and deaths through mishandled firearms every
| year, don't think you're exempt from that (or if you
| insist, at least do not talk down the need for safety).
|
| https://github.com/kubernetes/kubernetes/blob/master/pkg/
| con...
| xirbeosbwo1234 wrote:
| As someone else noted, I am taking a swing at Go's lack
| of generics.
|
| More to the point, I am criticizing the _reason_ for
| that. Designing a simple language is fine. I like simple
| languages a lot. Go was designed not because simple
| languages are good for some jobs but because Google
| decided their engineers aren 't up to using more powerful
| tools.
|
| I don't know Go. I've only written about 200 lines of it.
| I don't pretend to know whether or not it's any good.
| What I do know is that the reasoning behind it is bizarre
| to me.
| sdenton4 wrote:
| /Google decided their engineers aren't up to using more
| powerful tools./
|
| I think you fundamentally misunderstand the reason for
| using Go. It's NOT about whether a developer is/isn't
| capable of understanding how to write code with a
| particular set of tools.
|
| Instead, it's almost entirely about making that code
| simple to read and understand at a later date.
| Complex/'powerful' language tools complicate reading,
| which slows down later fixes and small modifications at
| best, and at worst leads to additional bugs in later
| iterations over the code. Thus, the core belief in Go's
| design is that 'powerful' languages are optimizing for
| entirely the wrong things.
|
| From my perspective, this is a good change of focus. I
| want simple tools that I don't have to worry about. We
| have finite attention, so we should actively try to
| reduce cognitive load whenever possible, as it frees up
| attention for other things. For example, it's a much
| better use of my time to think about bayesian
| optimization than whether an array pointer is being
| safely handled... If I need to worry less about the
| latter, I have more time to think about the former.
| somethingwitty1 wrote:
| I assume it is hyperbolic. The OP clearly has issue with
| the Go language. The rant contains the common
| misunderstandings about it (no generics, must be bad),
| etc. Go has survived 11 years without generics (they
| might be coming) and underpins some of the most popular
| software out there. Clearly, it has something going for
| it. Pike and Google understand generics, but generics
| have pitfalls. So when Pike and co decided to design a
| new language, they took lessons from the years of
| history, rather than repeating the same mistakes. Go is a
| language that is easy for people to learn, but more
| importantly, get right. It is just as powerful as
| virtually any other language out there, so caters to the
| advanced programmer as well. Those attributes are
| something not a lot of languages can legitimately claim.
| And people, for some reason, get really upset about it.
| _shrugs_. I say kudos to someone for building a language
| that isn 't a research project that crammed every
| possible "cool" concept in. I like learning languages and
| would rather appreciate them for what they are than
| whether they have X thing. If X thing is big enough to be
| a problem, then I don't use the language, simple. No need
| to get all worked up about it and post rants on unrelated
| articles.
| robocat wrote:
| > then makes them work in dumbed-down languages because
| they can't be trusted with power tools.
|
| The languages are "dumbed" down so that the resulting code
| is intelligible to those that work on the system, so that
| the code is communication.
|
| Overly smart tools allow a smart person to make mistakes so
| complicated that nobody can fix it (even themselves). Or a
| smart person builds great solutions so complex that nobody
| else can work on the code.
|
| A good engineer chooses restrictions that help themselves
| and others build better solutions that a team can work on.
| anonymousab wrote:
| Professionals with many years of experience could and would
| still make mistakes with C and C++. And many mistakes are
| very costly at Google's scale.
|
| Wanting to make the situation better through a simpler,
| safer fit-for-purpose tool doesn't mean an industry is
| flawed anymore than the prevalence of sawstops means that
| carpentry is flawed.
| kelnos wrote:
| Go makes concurrency easier (sorta) and eliminates some
| memory safety issues. But if you want a tool that helps
| you write more correct programs, you really need a much
| stronger type system than Go offers.
| stretchcat wrote:
| Holy spin. Rob Pike was explicitly talking about young
| inexperienced programmers who are _' not capable of
| understanding a brilliant language.'_ He wasn't talking
| about experienced developers and made that as clear as he
| possibly could. Go is made simple for novices, not safe
| for veterans.
| [deleted]
| xirbeosbwo1234 wrote:
| Go is not a particularly safe tool. It is a _simple_
| tool. That isn 't the same thing. Sophisticated type
| systems are designed to improve safety at the expense of
| adding abstraction.
| spion wrote:
| Its simple: he is not really a legend at all.
| saddlerustle wrote:
| The skills the median google engineer needs can absolutely
| be learned in three months at a boot camp but
| simultaneously those skills are worth a million a year to
| google. There's massive returns to scale of the
| infrastructure for effective software development, but very
| few organisations have figured it out.
| NegativeLatency wrote:
| having a near monopoly on online ad sales and search
| doesn't hurt either
| ossworkerrights wrote:
| WAANK doesn't always hire the best people. Most I interviewed
| from these were average. They did know how to solve high school
| algorithms tho.
| bubblicious wrote:
| No evolving application can be or stay free of bugs or security
| concerns, regardless of the people or company behind it.
| GoblinSlayer wrote:
| Only for the backend.
| gverrilla wrote:
| isn't this backend?
| kevincox wrote:
| This seems something trivial to miss. The developer is asked to
| put the player into a page that has basically just the player
| and exposes and API. The API should allow playing videos and
| playlists. They do the obvious thing and it all works.
|
| The fact is that the security here wasn't the default. They
| need to explicitly realize that this allows the website to list
| playlists and consider that this should not allow listing the
| playlist with the user's credentials.
|
| This seems like an incredibly likely vulnerability to me and I
| am not surprised that even "elite" programmers missed it.
| xirbeosbwo1234 wrote:
| I've learned to be suspicious of someone's reputation when I
| don't know what they've done to earn it. Everyone thinks Google
| employs the best engineers on the planet, but I suspect the
| reason most people believe that is just that everyone else
| does. How many people have actually come to believe that
| because they've done their homework?
|
| Google is an ad company. Their entire business model is based
| around manipulating public opinion. Don't trust a word you hear
| about them.
|
| Decide for yourself. Do the products Google makes look like
| they are made by the best engineers in the world? In my case,
| the answer is a resounding _no_.
| chubot wrote:
| Most bugs happen at the boundaries between what different
| people are working on. They're often process and architecture
| issues rather than programming issues. Security bugs often have
| this flavor.
| neetodavid wrote:
| Its too bad (in a way...) they couldn't get private video IDs to
| leak. It would have made an impressive combination with their bug
| posted earlier this month (Stealing Your Private Youtube Videos,
| One Frame at a Time
| https://news.ycombinator.com/item?id=25728175)
|
| Speaking of... do security researchers sometimes just sit on
| their discoveries in hopes that they will eventually lead to a
| bigger payout? I would be kicking myself if I had reported a bug
| for a relatively small reward that I could have leveraged in
| combination with another discovery
| AbuAssar wrote:
| That's why I don't browse the web while logged in
| google/fb/twitter. As I keep them in separated firefox containers
| fredley wrote:
| It's not about you, it's about your parents and grandparents.
| ulucs wrote:
| Visit their house and download the Firefox FB/Google
| Containment add-ons then. What is even the point of such
| comments?
| oh_sigh wrote:
| My grandmom was a programmer on a university mainframe in the
| 50s and learned haskell in her 90s
| TedDoesntTalk wrote:
| My grandma programmed an arduino with stepper motors to
| change her Depends adult diapers. It does not yet auto-
| detect wet diapers but that's next on the road map.
| gambiting wrote:
| Great. 99.999999999% grandmothers weren't.
| banjomet wrote:
| What do you mean by that?
| xphx wrote:
| It's an ageist way of saying that this exploit is less
| critical for people who take proactive counter-measures,
| and more affects less technically inclined or security-
| minded people.
| mosselman wrote:
| Ageist how? Who says you have to be a certain age to be a
| parent or grandparent? Sounds very ageist to me.
|
| And that is an example of how political correctness is an
| arms race.
| grlass wrote:
| You misunderstand: it's ageist to suggest that parents
| and grandparents are by definition not likely to be
| technical enough to use mitigations like containers and
| such.
|
| Which it is.
| isoskeles wrote:
| What is the point of this conversation? We're sanitizing
| language to protect the egos of everyone, at the expense
| of derailing a conversation that actually could relate to
| a lot of people here.
|
| My parents are NOT AT ALL technically savvy. My mother's
| web browser has a ton of bullshit addons all over it, or
| at least it did last time I looked at her computer in
| 2014-ish. I can't imagine she's gotten much better about
| this stuff. But we can't talk about this pattern because
| it could hurt the identity of older HN readers who are
| technically savvy, it's _offensive_.
|
| Ageism is bad when it's preventing people from getting
| work or engaging in society in a meaningful way. I simply
| do not care if it's used to make casual remarks with the
| specific intent of getting people to relate to an idea,
| e.g. people who don't know any better about privacy are
| actually people you know, most likely your parents or
| grandparents or some of their friends. And taking part in
| shutting down that conversation because of "ageism" is,
| IMO, worse than the ageism itself.
| cgriswald wrote:
| It's a flawed mental model that doesn't even communicate
| what the poster intended without assumptions that aren't
| justified.
|
| How do you think you get the sort of ageism that prevents
| older people from getting the job?
| isoskeles wrote:
| > How do you think you get the sort of ageism that
| prevents older people from getting the job?
|
| I think you get it from a multitude of reasons, including
| allowing interviewers to come up with bad faith
| assessments on culture fit and other un-quantifiable
| employment parameters that amount to nothing more than,
| "I liked or disliked the candidate." I'd even extend that
| logic to a larger cause, allowing _coworkers_ (i.e. same
| level individual contributors) to interview candidates,
| as I don 't think coworkers necessarily have the proper
| skills or incentives to neutrally evaluate future
| coworkers, especially not beyond, "I like this person
| because I can relate to them because we look the same,
| have the same interests, etc." This isn't strictly ageism
| either, it can affect people by class or race or other
| things that set them apart.
| throwaway2245 wrote:
| > it's _offensive_.
|
| I'd rather say: it's _wrong_.
|
| HN readers' parents are likely far more technically
| inclined than an average person.
|
| (The commenter did not invoke their own parents, which
| might be a slightly more reasonable position)
|
| Making a claim that HN's parents must be technically
| incompetent adds nothing to the thread, is likely to
| cause momentary confusion, and only contributes to the
| "bad" ageism that you are concerned about.
| [deleted]
| kuroguro wrote:
| Haha, he's kind of right - there's two assumptions there.
| Saying grandparents are old and saying grandparents
| aren't technically inclined.
| throwaway2245 wrote:
| The commenter said "your" parents and grandparents, who
| are by definition one and two generations older than
| "you", in age. I can't think of any other reason to
| invoke "your" parents and grandparents.
|
| If the point is that it's unhelpful to make irrelevant
| assumptions about parents and grandparents, then this is
| in complete agreement with the parent's point and is not
| a critique of it.
|
| This is not a clever gotcha.
| p1necone wrote:
| Don't be obtuse.
| wizzwizz4 wrote:
| > _And that is an example of how political correctness is
| an arms race._
|
| Is it so hard to be nice?
| johannes1234321 wrote:
| It is a bit an "elitist" comment in the beginning of the
| thread. The original comment can easily be interpreted
| (whether it was intended like that or not ...) as "there's
| no problem, I'm not affected, easy to avoid" to which the
| GP reacted "well, yeah, good for you, but other less tach
| davy people won't do" to which I would append "and they
| shouldn't have to. We should try to get such traps out of
| the net. Joe Average should be able to use the net in a
| productive and safe way"
___________________________________________________________________
(page generated 2021-01-18 23:00 UTC)