[HN Gopher] SmartTube Compromised
___________________________________________________________________
SmartTube Compromised
Author : akersten
Score : 150 points
Date : 2025-12-01 05:01 UTC (18 hours ago)
(HTM) web link (www.aftvnews.com)
(TXT) w3m dump (www.aftvnews.com)
| hollow-moe wrote:
| That's exactly why I didn't want to trust this app with a google
| account, it's mandatory to use it. SmartTube also requires
| permission to install applications for it's updater feature so
| it's also possible if the attack was targeted for the malware to
| install another app to get persistance.
| XiS wrote:
| Although it's very unfortunate this happened, and it shows a
| lack of security practices, this could happen to any all
| developer. Compromising other apps you do install.
|
| On my TV the app vanished and after some searching, it was
| disabled. I was kinda afraid Google had finally (ab)used it's
| Play Services power to ban it. But luckily it was because the
| developer marked it as compromised. All and all impact was
| minimised this way.
|
| I doubt your statement about requiring a Google account to be
| connected, as you can also import subscriptions instead of
| granting access to your account.
| kasabali wrote:
| > it's mandatory to use it
|
| I've been using it for years and I've never had to sign in.
| nubinetwork wrote:
| In an article about not downloading malware: "You can use my
| downloader! It's totally safe, bro!"
|
| Yeah, I'll pass.
| Algent wrote:
| The internal auto updater of the app directly use github as
| source, was this also compromised ? If malware was only on some
| random apkmirror upload then it should probably be fine for
| most users.
| hiccuphippo wrote:
| Apparently, yes. My guess is it was the Shai-hulud npm
| malware leaking their Github keys.
| jve wrote:
| I think this comment relates to the fact that article mentions
| AFTNews Updater app as a way to install SmartTube... not yet
| released version of software?
| GaryBluto wrote:
| It's kind of shocking to me that so many people would download an
| app like this and sign in using their actual YouTube account.
| dottjt wrote:
| I think it's more shocking to people how much YouTube Premium
| costs.
| M4v3R wrote:
| Is $14 dollars for ad-free, unlimited access to literally
| billions of videos really a steep price? Personally if I were
| to get rid of all but one of my media subscriptions I would
| stick with this one, since it's got everything -
| entertainment, education, inspiration, you name it.
| krige wrote:
| >ad-free
|
| hasn't been in over a year
| denkmoon wrote:
| ??? I've been on youtube premium / redtube since the
| beginning and I've been served 1 ad incorrectly in that
| time.
| rkomorn wrote:
| > YouTube premium / redtube
|
| I just googled redtube and uh... are you sure?
| codeflo wrote:
| YouTube Premium was originally called YouTube Red.
| Grandparent poster may have made a Freudian slip. :)
| rkomorn wrote:
| I know, I was just being... sassy. Partly because I
| didn't actually need to google it.
| denkmoon wrote:
| I'll never forget how out of touch they are :)
| fragmede wrote:
| YouTube Red was the previous name of YouTube Premium,
| probably renamed because of the unfortunate name clash
| you just noticed.
| Wilya wrote:
| Youtube premium is still ad-free. There is a Youtube
| premium lite which is kinda-ad-free-but-not-really, but
| the full ad-free one still exists.
| tcfhgj wrote:
| youtube premium has sponsorblock integrated now?
| fragmede wrote:
| basically, yeah. there's a white fast forward button that
| appears during frequently fast forwarded sections, which
| unsurprisingly happens to be sponsor sections.
| podgietaru wrote:
| Not to mention included YouTube Music. It's one of the few
| subs I pay for, because I watch a _lot_ of YouTube on the
| TV. And also like to have it in the background for
| "Podcast" style videos where the video is really only an
| accompaniment.
| microtonal wrote:
| That's actually worse. They used to have a separate
| YouTube subscription. I don't want (to pay for) YouTube
| Music, because I already have Apple Music and Tidal,
| which I prefer.
| jeffbee wrote:
| This is not accurate. The entire time that YouTube
| Premium (Red) existed, a subscription to it always
| included the music service.
| hombre_fatal wrote:
| Also, since Youtube Music is just a skin over Youtube,
| it's not true that your subscription must necessarily be
| cheaper if there were no Youtube Music.
| SoftTalker wrote:
| I'm the opposite. With YouTube Music, I don't need Apple
| Music, Spotify, Tidal, or any other service. For me,
| YouTube Premium is a good deal, and other than Fubo TV
| it's the only streaming media subscription I have.
| spaqin wrote:
| That's extremely subjective, but I'd rather save that $14 a
| month towards retirement. And if YouTube was only available
| with ads... well, that's no videos for me, maybe for the
| better, I would waste less time.
| didntcheck wrote:
| Sure, and you're free to
|
| 1. Save $14 for retirement and not watch Youtube
|
| 2. Save $14 for retirement and watch Youtube with ads
|
| 3. Pay $14 a month for Youtube without ads
|
| The only option that's not fair is expecting private
| companies and creators to give you entertainment and its
| delivery with nothing in return
| malka1986 wrote:
| Google is free to block me / my IP / ban my account.
| Workaccount2 wrote:
| In high school I knew a kid who would go around looting
| loose change from unlocked cars. He'd pull the driver
| side door open like it was his car, hop in, loot the
| center console, then hop out like nothing happened. He
| wouldn't take valuables (as far as I knew), just change,
| so maybe a few bucks per car.
|
| His rationale? "Nobody will cry over a few missing
| quarters and they are free to lock their doors anyway."
| malka1986 wrote:
| Blocking ads is the same as stealing.
|
| You are very intelligent.
| Workaccount2 wrote:
| The reason it's not stealing is because the cost to the
| serve content is tiny (spare change) and the sites don't
| stop you from viewing it with ad-blocker (unlocked
| doors).
| malka1986 wrote:
| The reason its not stealing is because stealing means to
| remove someone of the ownership of something they own.
|
| You are able to make your own definition though. The
| clear mark of a very intelligent mind.
| Workaccount2 wrote:
| I did not invent the definition of "IP theft" or the laws
| around it.
|
| But I suppose strictly speaking, theft is not the same
| word as stealing. I was not smart enough to get that.
| You're right, and I apologize.
|
| Not that ad-blocking is illegal, it's not, but it does
| bypass payment to creators for content they provide.
| Which functionally acts the same as theft.
| malka1986 wrote:
| It is yes. Your ability to create new meaning for words
| is awesome.
| consp wrote:
| Google uses your data and habits for profit. Dont pretend
| it's free.
| GoblinSlayer wrote:
| I get cat videos through messengers.
| londons_explore wrote:
| 14 dollars a month for a decade is $1680.
|
| To save $1680 I'd prefer to just use an adblocker (which I
| have done for the past decade)
| hhh wrote:
| Yes, and you choose to risk losing the most important
| platform to humanity next to Wikipedia. Youtube should be
| a public service.
| NaomiLehman wrote:
| YouTube wouldn't exist as a public service. there would
| be no incentive to make videos
| Kbelicius wrote:
| Why wouldn't there be incentives? If you are thinking
| monetary then the existence of youtube disproves your
| statement.
| graemep wrote:
| I am dubious about the importance of Youtube. If it
| disappeared tomorrow how long would it take for most
| videos to reappear elsewhere? Some of the creators I
| watch do have the videos available elsewhere. Veritasium
| is on Odysee, lots of people are on Nebula (and release
| videos there that are not on Youtube), etc.
|
| I think there is a good argument that having a single
| dominant platform has been harmful.
| fwip wrote:
| Imo, most videos would never be re-uploaded somewhere
| else. Currently-active creators that choose to keep a
| backup copy of their videos are probably the minority of
| creators.
| Rastonbury wrote:
| Insane hyperbole here, this guy's adblock = risking
| humanity losing it's 2nd most important platform owned by
| one of the most profitable companies in the world
|
| OpenAI thought of it first, should YouTube get a
| government backstop too?
| latexr wrote:
| Let's not get too hasty comparing YouTube to Wikipedia.
| Maybe what _you_ watch on YouTube is interesting and
| educational, but let's not forget it's also a major
| platform for misinformation, propaganda, conspiracy
| theories, radicalisation, scams...
| carlosjobim wrote:
| The hacker boy one day came back from school panting,
| sweating and exhausted. His father asked him:
|
| - What happened to you?
|
| - I figured that if I ran behind the bus, I'll save the
| $3 dollars the ticket costs-
|
| The hacker father smacked his son hard on the head and
| cried:
|
| - You fool! To run behind a bus like that! You should
| have ran behind a taxi instead and you would have saved
| at least $50 dollars!
|
| Then they both watched YouTube together the rest of the
| evening, thinking eagerly about all the juicy money they
| would save over the next decade.
| hiccuphippo wrote:
| 3 dollars is like a week of bus fares here and I remember
| a friend would walk back home from school to keep half
| the money.
| dottjt wrote:
| When the alternative is the exact same thing you describe
| but for $0 dollars, then yes.
| jfindper wrote:
| For sure! $0.00*
|
| * _$0.00 plus additional risk that the author of the
| alternative you are using is compromised, you end up
| using a malicious version of that alternative, and get
| pwned._
|
| Obviously for some/many, that trade-off is totally cool.
| But it needs to be included in the analysis, otherwise
| you're being dishonest.
| malka1986 wrote:
| I hate google, and I refuse to give them any money.
| tcfhgj wrote:
| $14 dollars better spent on liberapay
| graemep wrote:
| I am not going to watch billions of Videos.
|
| Its not entirely ad free, just fewer ads, AFAIK sponsored
| segments remain so there are still ads, sometimes quite
| lengthy ones.
|
| $14/month is $168 an year, and if you subscribe to multiple
| other video services the annual total is going to be quite
| high.
| cyberax wrote:
| SponsorBlock helps with them.
| graemep wrote:
| I do not use it because I do want to support the people I
| watch. I just skip manually if it is of no interest.
| cyberax wrote:
| I have YT Premium that pays much more than sponsors.
| That's also why I just use Firefox instead of third party
| apps to watch YT.
| Groxx wrote:
| essentially every YouTuber I've watched who discussed
| their financials said that their sponsorships brought in
| _several times_ more money than all forms of YouTube
| money.
|
| which is a very niche slice, and I have no idea how
| representative it is in aggregate. but sponsorships
| happen because they pay well enough to annoy _every_
| viewer, not just ones that aren 't using the better-
| paying Premium - they generally are not cheap, to say the
| least.
| cyberax wrote:
| Linus Tech Tips disclosed their finances: https://www.red
| dit.com/r/LinusTechTips/comments/1jjplow/ltt_... - and
| their sponsorships are less than the YT ads income.
|
| If you look at Premium, it's about 100x more lucrative
| than regular views. So I'm pretty sure I'm providing more
| money to creators than the skipped ads.
| Groxx wrote:
| To be clear: I completely believe that Premium is a major
| source for many people. 100%. I just haven't seen many
| examples of it, outside tubers that have _zero_
| sponsorships (because they 're small and/or not doing the
| low-value slightly-shady ones that get spammed
| everywhere). I'm _thrilled_ that Premium seems to pay
| relatively well, it 's better for everyone to move away
| from ads where possible.
|
| LTT though is a rather significant outlier in terms of
| subscribers (16.6 million right now). For truly large
| channels it's reasonable for the equation to be
| different.
|
| And the equation for them really is different. They're a
| company with ~100 employees1 and YouTube and video
| sponsorships came out to just 11.6% (ads AND premium) and
| 9.2% respectively of their multi-person company income.
| People claiming "SponsorBlock steals from creators"
| aren't talking about LTT, they're talking about smaller
| creators for whom YouTube stuff is a _majority_ of their
| income.
|
| Plus, like. Ads+premium lumped into one. It wouldn't
| surprise me if premium was lower than sponsorships.
|
| 1: https://en.wikipedia.org/wiki/Linus_Media_Group
| cyberax wrote:
| I know a couple of other creators, and a YT Premium view
| for them is about 10x more lucrative than
| sponsorship+ads.
|
| It completely changes if we're talking about non-Premium
| views.
| Groxx wrote:
| I suspect we're in different niches then or something. If
| ya don't mind sharing / have links handy, do you have any
| examples? I'm curious what kind of channel it works well
| for.
|
| I can try to hunt mine down, but most of the examples
| I've had were from a couple years ago, and YouTube's
| history is rather hard to search for stuff like that :|
| Not high odds of success.
| cyberax wrote:
| These are niche Russian-language channels (@Varlamov,
| @Max_Katz). They disclosed their finances to drive up
| Patreon/Youtube subscriptions because Youtube stopped
| monetization from Russia.
|
| I've been trying to find public numbers for English-
| language channels, but wow. So much slop.
| carlosjobim wrote:
| YouTube is 10x the quality and 10x the quantity than any
| other video service.
|
| As for the ads, YouTube Premium now has built-in sponsor
| skip. They can't really block sponsored segments, as that
| is a freedom of speech issue and also something they
| can't easily determine. Creators can just omit that some
| product is sponsored.
| hiccuphippo wrote:
| Youtube is both 10x and 0.1x the quality, and the
| official app has no way to filter it. They even removed
| the feature (downvotes) to let the user filter it.
|
| And the proliferation of AI videoslop is only making the
| 0.1x side larger and larger
| embedding-shape wrote:
| > YouTube is 10x the quality and 10x the quantity than
| any other video service.
|
| I guess you could say YouTube surfaces a larger span of
| quality, from really shit quality to incredible high
| quality, which I guess is cool. But since they provide
| zero tools to actually discover the really high quality,
| and on top of that decide they know better what I want to
| watch than me (like the subscriptions page not starting
| with the last published video), does that really matter?
|
| > as that is a freedom of speech issue
|
| It isn't. Freedom of speech in the US (since Google is
| based there, and maybe you too?) is about the government
| placing restrictions, not companies or individuals. As a
| individual (or company), you're free to limit the speech
| of anyone who want on your platform, for any reason. You
| might face public outcry, but it isn't a freedom of
| speech issue as it's on a private platform in the first
| place.
| carlosjobim wrote:
| They provide all the tools to discover high quality
| videos and channels. It's called "like and subscribe". If
| you use those features, it doesn't take long before
| YouTube shows you only high quality videos. And there's
| also the dislike button and "Do not recommend this
| channel again", if you need.
|
| > Freedom of speech in the US...
|
| Freedom of speech is a subject which is much larger than
| the US constitution. I'm not saying YouTube isn't legally
| allowed to block sponsored segments. I'm saying that they
| might not want to because they don't want to limit their
| creators' speech in that matter. Especially considering
| how easy it would be to side-step. What would be their
| reason? They've already made it easy to skip sponsored
| segments.
| hollerith wrote:
| >Creators can just omit that some product is sponsored.
|
| Not true in the US, where the FTC requires (and has
| required for decades) disclosure by the creator to the
| viewer whenever a payment has been made to the creator to
| promote anything. On Youtube, this is typically done by
| the creator's saying (in the video) "this video is
| sponsored by Foo Corporation", or, "I wish to thank the
| sponsor of this video, Foo Corporation".
|
| Personally, I'm unhappy with Premium's built-in sponsor
| skip. For one thing it becomes available to me only after
| enough previous viewers have manually skipped over the
| sponsored segment. For another, it sometime skips ahead
| too far (probably because the viewers who manually
| skipped weren't precise in skipping exactly to the end of
| the sponsored segment). I'd much rather Youtube allowed
| the uploader to declare (to Youtube) that the upload is
| free of sponsors (e.g., by checking a box) and then
| punishing the uploader somehow if he routinely declares
| falsely. With that information, Youtube could and IMHO
| should give me the option of telling Youtube somehow
| (e.g., by checking a box) that I prefer for sponsored
| videos to be omitted from my recommendations.
| carlosjobim wrote:
| I don't think individual YouTube creators are too much
| concerned about FTC rules and regulations.
|
| Although I like your idea about creators themselves
| having to declare to YouTube their sponsored segments.
| hollerith wrote:
| Individual Youtube creators in the US most certainly are
| concerned about the FTC and about this rule specifically
| because they do not want to find themselves in court
| explaining to a judge why they shouldn't pay a big fine.
|
| Also, if the creator doesn't follow the rule, the sponsor
| can be fined by the FTC, so even before the FTC notices
| the violation, the sponsor will probably notice and
| refuse to continue the relationship unless the creator's
| videos comes into compliance with the rule.
|
| Again, this rule has been in effect for decades in the
| US. Advertisements in the US must be labeled as such.
| Ditto paid endorsements.
| stronglikedan wrote:
| sponsored segments are skipped with a single button push,
| so they are negligible. it also comes with yt music
| homebrewer wrote:
| $14 is two days worth of living in my country for your
| average man on the street, among many other similar places.
| Imagine if you had to pay $200 to watch YouTube, that's how
| much these services cost for us.
|
| They refuse to correct for purchasing power parity and are
| left with nothing in the end. Steam seems to do very well
| in comparison.
|
| (I don't watch YouTube even for free, but practically
| everybody I know does without paying anything, and it makes
| a lot of sense).
| balamatom wrote:
| A semi-successful YouTuber in a low-income country is
| basically an infinite money hack. Neat little form of
| advance scouting, like this forum.
| carlosjobim wrote:
| There are a lot of things in this world besides YouTube
| Premium, which cost $14 or more. That some people in the
| world are very poor is no kind of argument as to how
| companies should price their products.
|
| "Purchasing power parity" is a non-concept for almost
| 100% of companies and products. But YouTube Premium is
| priced differently in different regions. Sometimes much
| cheaper than $14.
| embedding-shape wrote:
| The person you're responding to is not debating that the
| companies are setting the wrong prices, so no need to try
| to convince them that the companies are already setting
| prices "the right way".
|
| They're explaining for people who don't seem to
| understand, why people are fine signing in to these kind
| of 3rd party apps in the first place, because the
| subscription price ends up being what these people earn
| in days, not hours.
| ManlyBread wrote:
| $14 and I still have to run several plugins just to make
| the site actually usable. No thanks.
| RobotToaster wrote:
| For something that was previously free with only
| unintrusive ads, yes.
| StopDisinfo910 wrote:
| That's a very generous characterization of what most
| YouTube content is.
|
| My experience is that you are basically paying to remove
| the official ads from your disguised ads.
|
| The various algorithm tweaks for engagement these past few
| years and the introduction of shorts have significantly
| degraded the content quality and many good channels have
| just thrown the towel.
| mrguyorama wrote:
| Right, I want premium because it's a "fair" payment for
| the service I use and would help support the people who
| make good content, but the vast majority of those dollars
| go to the company who is solely at fault for encouraging
| and essentially requiring creators to use clickbait and
| fake thumbnails and put out slop every single day and
| never ever ever try doing something slightly different
| and consistently change things in ways that _those
| creators do not want and hate_. Every complaint you
| likely have about youtube content was _forced_ by youtube
| for their own profitability. Don 't like sponsorships?
| People mostly started seeking them out after Google cut
| ad payouts essentially in half with no warning. Don't
| like videos being way longer than they need to be? That's
| because youtube started paying out based on watch time
| instead of views and that encourages padding. Don't like
| censorship? It was Youtube's choice to shadowban/punish
| anyone who even said the word pandemic during a literal
| global pandemic that people probably wanted to talk
| about, even in passing. Buy into Youtube's new "channel
| member" feature in good faith? Well then Youtube changed
| it so that the videos that only members can watch are now
| shoved in front of everyone's eyeballs _without your
| approval or desire or asking_ and it 's really annoying
| to all your viewers. Don't like every video spending 30
| seconds telling you to subscribe and "hit that like
| button" and then the fucking bell? That's because google
| decided that if your video didn't have a high enough
| click through rate, it wouldn't be shown to subscribers
| at all, and then introduced the bell for "subscribers but
| for real", and then even that hasn't really been honored.
| Youtube has for example suddenly decided that I should be
| shown low view russian language plagiarism of videos I
| like that have then been autodubbed back into english
| rather than _the video from one of my subscriptions that
| was copied to make the russian video_. How is that
| supposed to help anyone?
|
| I will happily pay for youtube when they show that they
| want to encourage good content and help empower the
| people who make that good content, but Google doesn't
| want to do that because Mr Beast slop advertising to your
| kids is more profitable.
|
| So I pay for Nebula instead.
| prmoustache wrote:
| > for ad-free
|
| Most youtube content being disguised ads, this cannot be
| true.
| hansvm wrote:
| It's >12x the ad revenue they bring in per monthly-active
| YouTube user (suggesting they'd still be happy with a much
| lower price), and the price has increased 75% in the last
| decade (compared to the 40% real inflation over that
| period, suggesting they intend to continue increasing the
| price till public backlash or other effects reduce their
| total revenue). Plus they're boiling the frog, slowly
| adding ads back in to music and shorts for premium users,
| and we'll see how far that initiative goes.
| pcthrowaway wrote:
| > Plus they're boiling the frog, slowly adding ads back
| in to music and shorts for premium users
|
| Do you have a source for this?
|
| I do value watching unlimited youtube videos without ads,
| but if they're gonna add the ads back in, I'd easily stop
| paying for the one google product I currently pay for
| (and honestly the only reason I haven't _already_ done
| this is laziness and convenience)
| jeffbee wrote:
| > the price has increased 75% in the last decade
|
| It launched at $9.99[1] and is now $13.99[2] which I
| believe to be a 40% increase, i.e. flat in real dollars.
| If like most people you subscribe for a year, it's only
| $11.67/mo.
|
| 1: https://www.cnet.com/tech/services-and-
| software/youtube-free...
|
| 2: https://www.youtube.com/premium
| hansvm wrote:
| I was going off the 7.99/mo price I first paid (which
| they've recently stopped grandfathering in). Was that not
| a common amount people paid?
| jeffbee wrote:
| This suggests that you initially subscribed to Google
| Play Music at their launch special price, and were later
| grandfathered into getting YouTube Premium at the same
| price, or that you used YouTube Music Key (yes, more
| product roadmap confusion!) with the same outcome, or
| that you signed up with a student account (this is still
| $7.99 today).
| bigyabai wrote:
| Thanks for paying $14/month to support my ad-free yt-dlp
| archive, shmuck.
| armarr wrote:
| I have premium but also this app. It has SponsorBlock and
| better UI customization than the official one.
| tcfhgj wrote:
| I really couldn't care less about me youtube account
| GaryBluto wrote:
| YouTube accounts and Google accounts have been one in the
| same since 2009.
| lan321 wrote:
| Obligatory call to free yourselves from having GMail as
| your (only) main email and especially to not tie it to YT
| or other unrelated services.
|
| I can absolutely imagine my YT accounts at some point
| getting banned for using adblock, some stupid private
| upload or some comment.
| temp0826 wrote:
| Having your own domain name is the best option (ideally
| not hosting on gsuite!)
| defrost wrote:
| Many people have had multiple gmail accounts since 2004.
|
| I have a gmail account used solely for google store and
| Android TV related verifications that's unlike other
| business, personal, registration, or spam email accounts.
|
| The TV's in the house, smart wifi devices, and guest wifi
| accounts are on separate subnets, the NAS hosted media has
| limited read only keyhole access accounts for TV apps to
| use.
|
| Whether it's SmartTube or any other app (iView, SBSOnline,
| Netflix, etc) it's wise to assume that anyone can be
| comprised by malware to sniff traffic for (say) bank
| account passwords, host bots for DDOS or mining, etc.
| tcfhgj wrote:
| how does this matter?
| homebrewer wrote:
| You risk losing your entire Google account along with all
| documents, photos, mail, and whatever else you have
| there. Enough stories of this happening if you look
| around.
| tcfhgj wrote:
| you risk that regardless, which is why I don't rely on
| them at all
| prmoustache wrote:
| The risk always exist.
|
| Also are you really using same account for gmail, your
| personal pictures/docs and youtube?
| Zambyte wrote:
| > Also are you really using same account for gmail, your
| personal pictures/docs and youtube?
|
| Most people use "sign in with Google" and tie their
| Google account to services well beyond the Google
| ecosystem, just to avoid creating a new entry in their
| password manager (lol). You think people are making new
| Google accounts for each Google service? That's hard for
| me to believe.
| prmoustache wrote:
| Not necessarily everyone but I would expect the
| population visiting hacker news to do so.
| SoftTalker wrote:
| If you're just a normal user the risk is very low. This
| almost always happens when someone using Google APIs for
| business purposes trips a fraud or spam detector.
| VerifiedReports wrote:
| one AND the same
| prmoustache wrote:
| You don't use a dedicated account for youtube?
| impulsivepuppet wrote:
| I can't help but think that this is a "I have nothing to
| hide" argument. It's quite sisyphean to keep accounts
| perfectly segregated, therefore there's always a chance that
| personal information can be traced back and pieced together;
| which, in turn, has "boring-old security" implications: i.e.,
| now someone possibly knows your habbits and times when you
| are at work
| tcfhgj wrote:
| my "personal" information there is as personal as my
| profile here
| jfindper wrote:
| thats super cool! some people care a lot, some people dont
| care at all. what a strange world.
| retSava wrote:
| It's not just cost and ads. It's having the possibility to
| reduce attempts to manipulate my inner reptile brain. With
| various clients, you can disable shorts, recommended, you have
| sponsorblock, you can replace youtube-face-thumbs with actual
| thumbs and get crowd-sourced titles that better reflect the
| contents.
|
| I also don't need to manually go set speed to 1.75x and enable
| subs in english, it's a one-time setting. _Further_ I can
| download a video locally, for whatever reason (later viewing,
| bw throttling, risk of deletion, etc).
|
| As if that weren't enough, I don't have to watch videos logged
| in, my client is just set up to download my select channels.
|
| I now see zero use of a youtube account.
| moondowner wrote:
| Sometimes people download it because there's no alternative.
| E.g. the YT app is not available in the play store in their
| country on that specific hardware, so the only way to be able
| to view YT is to use an alternative app like this one.
| ninalanyon wrote:
| > the only way to be able to view YT
|
| Surely you can use a web browser?
| zero_iq wrote:
| The user experience accessing YouTube through a web browser
| on a TV (the main target audience for SmartTube) is less
| than ideal.
|
| TV and set-top box browsers tend to be slow and fiddly to
| use from a TV remote. (And often running on underpowered
| hardware).
| rdsubhas wrote:
| Google Account.
|
| Not Youtube account.
| aix1 wrote:
| Technically correct but somewhat misleading. The app in
| question only asked for the following Google account
| permissions: 1. Manage your YouTube account
| View and manage your videos and playlists View and
| manage your YouTube activity, including posting public
| comments 2. View and manage your [YouTube] rental and
| purchase history Your rental and purchase history
| may be displayed and accessible on this device.
| Arbortheus wrote:
| The cost of being brainwashed by ads and sponsor slots is also
| high.
|
| Even with YouTube Premium you don't get the feature set you get
| with SmartTube. The sponsor block integration on my TV is
| brilliant.
| drewg123 wrote:
| It has a far better user interface than the official YT
| interface. And that interface can be heavily customized to your
| exact preferences.
|
| My wife has YT Premium, and we find ourselves watching YT in
| SmartTube just because the interface is so much better.
| leptons wrote:
| Same here, we also both have YT Premium and use SmartTube.
| Our dislike of "Shorts" pushed everywhere in the YT app is
| what got us to switch to SmartTube. We watch Youtube on our
| 65" TV via Chromecast, so shorts are just really a crap
| experience and we do not want to see them at all. SmartTube
| lets us eliminate them, as well as all the other awesome UI
| customization makes it a far superior experience.
| polski-g wrote:
| Its such a good client. With the YT Roku app, if you change
| playback speed, quality will drop to 720p or lower. SmartTube
| lets me watch at full 1080p with 1.5x speed.
|
| No ads is of course a big plus too.
| boje wrote:
| I really hope Google doesn't pick this out (and similar events)
| as further justification for getting rid of APK-based
| installation.
| HackerThemAll wrote:
| Blocking file-based installations was never planned. It's fake
| news and always has been. It's all about requiring code signing
| for all code so that malware-spreading authors can be easily
| blocked by adding their signing key fingerprint to the
| blocklist.
|
| It doesn't matter whether the app is installed via Play Store,
| Huawei's or Samsung's store etc., or from APK.
| a2128 wrote:
| This is a drastic misrepresentation of the situation. All
| Android apps already have code signing, you cannot install an
| app unless it has a signature, and any future updates are
| blocked unless the signature matches. This is how it's been
| practically since the start of Android, it's part of the
| security model to prevent something like a malicious Firefox
| APK stealing your cookies.
|
| What's new is that they were gonna block installations
| outside of Google Play, unless the developer has signed up
| for Google Play Console and has gone through a verification
| process there, whitelisting their signing key fingerprint.
| However, they've walked back on this and said they'll create
| a new "advanced flow" for "advanced users" that's "designed
| to resist coercion" to bypass this restriction. Door in the
| face technique IMO, the existing 12-step process to
| installing an app was already complicated enough.
|
| So effectively the result is that file based installations
| will be blocked unless Google has specifically whitelisted
| their key through the Google Play Console verification
| process, or the user goes through this "advanced flow" which
| we're yet to see any details of
| tgsovlerkhgsel wrote:
| "Malware spreading authors" or "ToS violating authors" or
| "authors of piracy apps"?
| altfredd wrote:
| What an absolute boatload of lies.
|
| I am currently in process of "verifying" my identity with
| Android Developer console.
|
| In addition to proof of identity (e.g. passport/driver
| license) Google is demanding a proof of address, government
| registration, this month's rental agreement, foreign
| passport... The process is stuck in limbo because months-old
| documents are deemed "outdated", and I am constantly
| threatened that my verification request (!) will be denied
| because of "exceeding allowed number of attempts" (!!)
|
| It shares the same principle as silent Discord account bans
| and other "verification" harassment schemes, such as Upwork
| account verification. The excess developers -- Google's
| potential competitors -- need to be banished from platform as
| quickly and cheaply as possible, so that Google can peddle
| their own spyware unimpeded.
| breakingcups wrote:
| The official announcement is very sparse on details. If the
| developer doesn't know _how_ his digital signature (and update
| infrastructure?) was compromised, how does switching to a new
| signature help? It could get compromised in the exact same way.
| Kbelicius wrote:
| The article linked here brings some more details, but also, the
| official statement doesn't use the word "compromised". If it
| did, well it would be a statement with different meaning than
| the one that was released for us to read.
| reassess_blind wrote:
| What can malware in an apk do?
| tgsovlerkhgsel wrote:
| Most likely load arbitrary binary code and execute it. Which
| also makes it really hard to figure out what it actually did.
|
| Among the options of what _could_ be pushed:
|
| - proxyware, turning your network into a residential proxy that
| can then be sold to anyone willing to pay for them to commit
| crimes, send spam, scrape, ... with your IP [I believe this is
| the primary suspect here]
|
| - other standard botnet crap like DDoS bots
|
| - exploits that try to break out of the sandbox to establish
| persistence, steal other data, or steal your Google account
| token
|
| - code that steals all data/tokens that the app itself has
| access to
|
| - adware that shows ad notifications etc.
|
| - ransomware that tries to prevent you from leaving the app (of
| course this works best if they get a sandbox escape first, but
| I'm sure you can get pretty close with just aggressive creative
| use of existing APIs)
| avereveard wrote:
| Really hate this "something was found" announcements
|
| Which channel distributed the compromised apk? What is the
| signature of the payload injected? What is the payload, what does
| it do?
| leo_e wrote:
| This will inevitably be used as ammunition against sideloading,
| but it's really a lesson in supply chain trust.
|
| When we move away from walled gardens (which I support), the
| burden of verifying the "chain of custody" shifts to the user.
| Installing an APK that auto-updates with root/system privileges
| is essentially giving a single developer the keys to your living
| room.
|
| We need better intermediate trust models--like reproducible
| builds signed by a quorum of maintainers--rather than just "trust
| this GitHub release."
| Klaus23 wrote:
| A lot of people installed malware and, to be honest, nothing
| really happened. They might have had to change their passwords,
| but it could have been much much worse if Android didn't have
| good sandboxing.
|
| I hope that Flatpak and similar technologies are adopted more
| widely on desktop computers. With such security technology
| existing, giving every application full access to the system is
| no longer appropriate.
| ninalanyon wrote:
| Why do you need Flatpak for sandboxing?
|
| I really dislike Flatpak for installing multiple identical
| copies of the dependencies.
|
| Just give me some easier to use tools to configure the access
| that each application has.
| Klaus23 wrote:
| > Why do you need Flatpak for sandboxing?
|
| You don't, but as far as I know, Flatpak or Snap are the only
| practical, low-effort ways to do it on standard distros.
| There's nothing stopping flatpak-like security from being
| combined with traditional package management and shared
| libraries. Perhaps we will see this in the future, but I
| don't see much activity in this area at the moment.
| TechSquidTV wrote:
| Happy YouTube Premium customer here
| leptons wrote:
| I'm a happy YouTube Premium customer too, as well as a happy
| SmartTube user. The UX is just so much better in SmartTube than
| the Youtube app. So much customization is possible, and we can
| completely eliminate every bit of "Shorts".
| sfRattan wrote:
| Announcement from the dev, in the project GitHub and Patreon:
|
| _Friends, it seems that my digital signature has been exposed.
| This signature protects the app from fake and malicious updates,
| so there is a risk that someone may try to release counterfeit
| versions under my name.
|
| To completely eliminate any threats, I've decided to stop using
| the current signature and switch to a new one. Because of this,
| the app's identifier will also change. You don't need to delete
| the old app (but it will no longer receive updates) -- the new
| one will install as a separate app and will need to be configured
| again.
|
| Thank you for your understanding and attention to
| security._[1][2]
|
| ---------------
|
| There aren't any new apk releases on GitHub yet. However,
| concerningly, the SmartTube website (which I won't link directly)
| still offers undated "Stable" and "Beta" downloads.
|
| It sucks to deal with security breaches as an indie or solo dev,
| but I'll be waiting for a more detailed postmortem before
| assessing whether to install a future release... Hopefully one
| that details new security procedures to guard both the dev's key
| and the production build environment.
|
| Factory resetting my Shield as a precaution, but nothing
| sensitive was really on there, and Android's security model did
| exactly what it was supposed to and limited the damage. When
| using a third party app like this, it's prudent to use it signed
| out or else with a purpose specific Google/YouTube account which
| is connected to nothing else critical.
|
| [1]:
| https://github.com/yuliskov/SmartTube/releases/tag/notificat...
|
| [2]: https://www.patreon.com/posts/important-144473602
| DoctorOW wrote:
| > _To completely eliminate any threats, I've decided to stop
| using the current signature and switch to a new one. Because of
| this, the app's identifier will also change. You don't need to
| delete the old app (but it will no longer receive updates)_
|
| I'm curious if this is the best idea? Like, if you don't read
| all the GitHub releases thoroughly or miss the HN material, and
| instead you just auto-install updates, you downloaded a
| malware-infested version which will be on your device until you
| learn otherwise?
| sfRattan wrote:
| At this point, Play Protect will remove the apks with the old
| signature because the developer marked the old signature as
| compromised. _The developer acted correctly and responsibly
| in doing so_ , and seems to be working out establishing a new
| setup now, including a new signing key.
|
| For those using sketchy devices without Play Protect and also
| installing random apks without an understanding of security
| or Android's trust-on-first-use model, there's not much
| anyone can do.
| nickthegreek wrote:
| from my understanding,
| https://github.com/yuliskov/SmartTube/releases/download/late...
| links to 30.56, which the newest clean version. Old app stopped
| at 30.48.
|
| I installed 30.56 from the git link on my Shield. It did not
| overwrite the old one, as it has the old signature. I manually
| uninstalled 30.48. I did not use the backup/restore option in
| either as I didnt want to dirty any data in the new app.
| sfRattan wrote:
| For me, the link to just the releases returns an empty list
| at present:
|
| https://github.com/yuliskov/SmartTube/releases/
| bl4kers wrote:
| Backup/restore is just XML files that you can open and
| inspect
| embedding-shape wrote:
| > SmartTube's developer told me that the computer used to create
| the APKs for the project's official GitHub page was compromised
| by malware. As a result, some official SmartTube releases were
| unintentionally released with malware.
|
| Seems it's lacking in information about how a malware manages to
| compromise supposedly signed releases? Do authors not have the
| production signing keys behind a password or similar, and review
| 100% of the changes before they deploy stuff?
|
| I swear the more time goes on, the more I'm loosing faith in the
| entire ecosystem. People running random binaries on the same
| device they do banking on always surprised me, but now developers
| manages to get malware on their developer machine and are
| publishing random binaries to other strangers???
| arccy wrote:
| the malware need not actively create a release like a worm, it
| can just infect every build and if you don't check carefully,
| your next regular release will contain it.
| red-iron-pine wrote:
| is one of the reason we fight holy wars for SSO and strict
| login rules even for Dev or QA environments -- if you can get
| in during a dev build you can get stuff in there that carries
| through.
|
| maybe QA will find it... but they're testing X number of JIRA
| tickets based on Y epics and if it's not on the list they're
| not looking...
| lostmsu wrote:
| > Do not download SmartTube from any app store, APK websites or
| blogs; these were uploaded by other people and may contain
| malware or ads. SmartTube is not officially published on any app
| store. Sadly, the Google PlayStore does not allow ad-free Youtube
| apps using unofficial APIs.
|
| Maybe should actually switch to releasing via F-Droid.
| catlikesshrimp wrote:
| >>"It is likely the presence of this malware that caused Google
| and Amazon to forcibly uninstall SmartTube on some devices, ... "
|
| Where can I read more about *unrequested uninstalls*? Google
| search only shows results about how impossible it is to remove
| phone default apps.
| mmmlinux wrote:
| So we all agree google is probably behind this, right?
| bl4kers wrote:
| Thought it was worth mentioning the developer is Ukrainian. If it
| was a targeted attack, certainty could be state-sponsored by
| Russia
___________________________________________________________________
(page generated 2025-12-01 23:01 UTC)