News for hackers. Stuff that matters.
Re:Leaking the email of any YouTube user for $10,000 by nullderef on Wednesday February 12, 2025 @07:11AM (#43024536)
Breaking the email system so that it's not sent is the cherry on top. With companies as big as Google who have developed so many products, "security" feels fake. If every line of code is a possible vulnerability, with millions it's just inevitable. It feels like the only way is to keep things simple (e.g., deprecate the recorder site), but even then.
Re:Leaking the email of any YouTube user for $10,000 by rpigab on Wednesday February 12, 2025 @08:15AM (#43025084)
That's probably another reason why Google kills so many products that are successful, but not successful enough for Google's whole system to justify keeping them alive and secure.
Re:Leaking the email of any YouTube user for $10,000 by echelon on Wednesday February 12, 2025 @08:58AM (#43025470)
100%. Every product not a part of the core mission is attack surface area, ongoing maintenance to ensure it works with the rest of Google services and infra, and drag on the rest of the team and velocity.

The part that sucks for consumers is that they often kill things that people like. I wish they had a better way of doing this.

Bravo to brutecat for this excellent discovery, productionization, and writeup.

Re:Leaking the email of any YouTube user for $10,000 by zoklet-enjoyer on Wednesday February 12, 2025 @09:14AM (#43025613)
They could spin these products off into separate companies and cut the integration with the rest of the Google ecosystem.
Re:Leaking the email of any YouTube user for $10,000 by scarface_74 on Wednesday February 12, 2025 @10:26AM (#43026296)
Where is the profit for the individual product? There are a lot of services at every BigTech company that would not make sense as an individual product. But they make the overall ecosystem better or make money only because they are a part of the larger company.

That’s part of the stupidity of the DOJ trying to force Google to sell Chrome. Who would want it? And how would they profit from it?

Re:Leaking the email of any YouTube user for $10,000 by hypothesis on Wednesday February 12, 2025 @02:20PM (#43028768)
> That’s part of the stupidity of the DOJ trying to force Google to sell Chrome. Who would want it? And how would they profit from it?

All valid questions, but it might be that splitting the tool used to bludgeon everyone around is still worth it, even if pace of development slows down considerably.

Re:Leaking the email of any YouTube user for $10,000 by scarface_74 on Wednesday February 12, 2025 @02:46PM (#43029017)
There will be no development. Who is going to spend money to develop it and why would they? Microsoft even decided it wasn’t worth it to develop their own engine.

Unless you are using Chromebooks, every desktop user who uses Chrome made an affirmative choice to download it.

Re:Leaking the email of any YouTube user for $10,000 by hypothesis on Wednesday February 12, 2025 @03:11PM (#43029255)
> There will be no development.

My point is that maybe it is okay? Runaway churn is at least partially responsible for current situation, where most companies simply unable to compete.

Re:Leaking the email of any YouTube user for $10,000 by scarface_74 on Wednesday February 12, 2025 @03:23PM (#43029376)
What companies are trying to “compete” in the browser space?

Apple has no reason to compete, it can just make more and more functionality for native apps as can Google if it doesn’t have to worry about Chrome anymore.

Microsoft doesn’t care about the browser anymore and just uses Chromium. Firefox’s revenue comes completely from Google. If Google doesn’t have to prop up Firefox for antitrust reasons anymore, why would they?

Re:Leaking the email of any YouTube user for $10,000 by rvba on Thursday February 13, 2025 @01:23AM (#43033252)
The firefox admin are making millions of dollars per year even if they make one bad decision after another (mostly focusing on acqusitions and new projects instead of actual work on their core product: firefox).
Re:Leaking the email of any YouTube user for $10,000 by echelon on Wednesday February 12, 2025 @09:18AM (#43025653)
Probably way too much effort. The apps aren't built for generic infra, but rather Google's internal weirdware. It wouldn't be possible to run it anywhere else without a rewrite.
Re:Leaking the email of any YouTube user for $10,000 by throwaway2037 on Wednesday February 12, 2025 @09:50AM (#43025915)
I agree, and I like this term "internal weirdware". Real question: Why don't we see more start-ups try to clone old terminated Google services with a freemium model?
Re:Leaking the email of any YouTube user for $10,000 by scarface_74 on Wednesday February 12, 2025 @10:27AM (#43026306)
People don’t want to pay for things.
Re:Leaking the email of any YouTube user for $10,000 by eitland on Wednesday February 12, 2025 @02:56PM (#43029105)
I want. And I do. Notable examples are Kagi.com and Raindrop.io. I've also been sponsoring a number of projects for a number of months, from journalism to social media startup.

But I am getting more hesitant as often when I (and others) do it seems companies think they can increase their prices wildly or do other stuff.

I have this exact feeling now with Logseq: I started paying for sync a while ago and it seems so did others and now they are rewriting the whole thing from plain text[1] to some kind of database based storage :-/

[1]: which could be synced over git, transferred effortlessly into another application and was one of the reasons I went with Logseq

Re:Leaking the email of any YouTube user for $10,000 by scarface_74 on Wednesday February 12, 2025 @03:15PM (#43029291)
How many of those companies are profitable? How many do you think you will see a blog post about in a year or two - “Our Amazing Journey” where they won’t either go out of business or get acquired and their product gets shut down”?

From Kagi’s website

https://blog.kagi.com/status-update-first-three-months#:~:te...

We are currently serving around 2.1M queries a month, costing us around $26,250 USD/month.

Between Kagi and Orion, we are currently generating around $26,500 USD in monthly recurring revenue, which incidentally about exactly covers our current API and infrastructure costs.

That means that salaries and all other operating costs (order of magnitude of $100K USD/month) remain a challenge and are still paid out of the founders’ pocket (Kagi remains completely bootstrapped).

Re:Leaking the email of any YouTube user for $10,000 by freediver on Wednesday February 12, 2025 @09:25PM (#43032038)
Wrong blog post, try this one ;)

https://blog.kagi.com/what-is-next-for-kagi

Re:Leaking the email of any YouTube user for $10,000 by scarface_74 on Wednesday February 12, 2025 @10:09PM (#43032268)
So what do you know about kagi’s profitability :).

I’m honestly glad to hear that. Until I heard your interview with Gruber, I thought Kagi was the same company that use to provide a payment platform for Mac indie developers.

It’s always good to see a bootstrapped company become successful without enshittification. I put you up there with BackBlaze.

I see you have investors now (not saying that is a negative). Are the laws still the same about having to be a “qualified investor”? Can anyone invest - asking out of curiosity.

Re:Leaking the email of any YouTube user for $10,000 by freediver on Friday February 14, 2025 @02:47AM (#43045920)
For the particular type of investment we were doing (angel list roll up vehicle with basically our users) one needs to verify they are an accredited investor.
Re:Leaking the email of any YouTube user for $10,000 by aqueueaqueue on Wednesday February 12, 2025 @01:02PM (#43027901)
There probably are. The real question is why are they not successful. Maybe they need to solve distribution. I use Google Calendar tasks for todos because it is there, handy, for example.

As sister comments have said there is no money in it. They are stickiness plays or just bets for Google.

Re:Leaking the email of any YouTube user for $10,000 by ragazzina on Wednesday February 12, 2025 @10:23AM (#43026263)
Maybe Apple should do the same and kill their many half-baked software products.
Re:Leaking the email of any YouTube user for $10,000 by gallerdude on Wednesday February 12, 2025 @10:58AM (#43026632)
Which ones? In my experience, a lot of Apples products have incredible longevity. Notes, Calendar, Pages all just get better and better.
Re:Leaking the email of any YouTube user for $10,000 by ragazzina on Wednesday February 12, 2025 @11:55AM (#43027171)
Alarms, Photos, Siri, Books..
Re:Leaking the email of any YouTube user for $10,000 by azinman2 on Wednesday February 12, 2025 @12:33PM (#43027583)
How are any of these half baked? (Aside from obvious Siri deficiencies)
Re:Leaking the email of any YouTube user for $10,000 by ragazzina on Wednesday February 12, 2025 @12:45PM (#43027698)
Alarms is unreliable for the basic functionality of waking you up.

Photos redesign makes it really hard to use.

Siri works half of the times, maybe even less than that.

Books lacks of basic functionalities such as downloading and keeping books on device.

Re:Leaking the email of any YouTube user for $10,000 by azinman2 on Wednesday February 12, 2025 @12:53PM (#43027784)
How are alarms unreliable?

Photos redesign maybe something you don’t like, but you can hardly call it half baked. All of the functionality is there and there’s a new consistency in how it works that wasn’t there previously.

Books automatically downloads to device. There isn’t a way to read a book without it local.

Re:Leaking the email of any YouTube user for $10,000 by ragazzina on Wednesday February 12, 2025 @01:26PM (#43028186)
> How are alarms unreliable?

A simple google search will answer this question

https://www.theverge.com/2025/1/9/24340238/apple-iphone-alar...

Even an hn search is fine, if you do not trust the Verge (notice these are comments from the last 3 months so not an old issue):

https://news.ycombinator.com/item?id=42705217 https://news.ycombinator.com/item?id=41887505 https://news.ycombinator.com/item?id=41962418

> Books automatically downloads to device. There isn’t a way to read a book without it local.

Have you used Books extensively or just skimmed it? There's no way to keep books on device, make another Google search if you do not believe me.

> Photos redesign maybe something you don’t like, but you can hardly call it half baked.

Perfect, then keep Photos and kill only alarms, books and Siri.

Re:Leaking the email of any YouTube user for $10,000 by azinman2 on Wednesday February 12, 2025 @01:38PM (#43028318)
I’ve never had my alarm fail, but it looks like others have hit this bug. So by your definition if a product has a bug (even if rare but intrinsic to the functionality), then it’s half baked. Given (effectively) all software has bugs, then by your definition there are no fully baked software products. I think we have very different definitions of what makes a product half or fully baked.

I haven’t used Books extensively outside of audiobooks. So it sounds like there’s offloading of caching going on that’s iCloud wide; disabling iCloud sync would fix this. I can imagine that being frustrating if the book you want isn’t there when you’re on a flight (which should only happen if you haven’t recently accessed it). I agree there should be a way to prevent this. I wouldn’t call that half baked, but it’s a big enough problem I’d agree that’s not fully thought through (or more likely, they did think through it but came to a different conclusion).

Re:Leaking the email of any YouTube user for $10,000 by lilyball on Wednesday February 12, 2025 @02:35PM (#43028902)
> Have you used Books extensively or just skimmed it? There's no way to keep books on device, make another Google search if you do not believe me.

Once you download a book to a device, it stays downloaded. There is a setting to automatically remove downloads once you're finished with the book, but that defaults to off (and I didn't even realize it was there until I went looking just now).

Re:Leaking the email of any YouTube user for $10,000 by ragazzina on Thursday February 13, 2025 @09:33AM (#43036202)
>Once you download a book to a device, it stays downloaded.

This is objectively false. I suggest you do a simple google search or read my other comment.

Re:Leaking the email of any YouTube user for $10,000 by lilyball on Thursday February 13, 2025 @07:51PM (#43043376)
I read your other comment. It looks like you're talking about iCloud Storage there. Books downloaded from the Apple Books Store do not go into iCloud Storage. Books you've uploaded are stored in iCloud.

I just checked my phone, I have 169 books downloaded. This includes many books I haven't looked at for years and years. This includes many books that I bought 3, 4, 5 iPhones ago and are still present, copied from device to device, because Books does not remove store downloads unless asked to.

Re:Leaking the email of any YouTube user for $10,000 by pixelesque on Wednesday February 12, 2025 @02:33PM (#43028886)
Probably a few times every quarter I have iOS alarms that didn't go off for some reason on my iPhone.

It's happened for years: it was pretty bad about 5/6 years ago, but Apple claimed they fixed it, but it's still happening a bit.

In fact, when I really need to wake up at a particular time (say for a flight), I set two alarms 1 minutes apart.

Re:Leaking the email of any YouTube user for $10,000 by SirMaster on Wednesday February 12, 2025 @05:39PM (#43030550)
Seems like there is more to this. I have been using iPhones since they came out and can't think of a time my alarm never worked, and I use them multiple times a day.
Re:Leaking the email of any YouTube user for $10,000 by aqueueaqueue on Wednesday February 12, 2025 @01:04PM (#43027929)
They are not. I haven't seen an unreliable alarm since the digital age. 1980s LED alarm clocks were reliable.
Re:Leaking the email of any YouTube user for $10,000 by superb_dev on Wednesday February 12, 2025 @01:36PM (#43028294)
What are you talking about? I’ve got the books app open now, I can see all of my downloaded books. In fact there’s a whole section in the library for my downloaded books!

Go to library > collections > downloaded.

I can see books I purchased and other PDFs that I uploaded.

I do agree on the Photos redesign. I feel like I constantly get stuck on certain pages.

Re:Leaking the email of any YouTube user for $10,000 by ragazzina on Wednesday February 12, 2025 @01:50PM (#43028425)
> What are you talking about?

Your tone is aggressive and uncalled for. In fact, the fact that you have never found a very common bug says a lot about your inattention to detail.

There's no "keep forever on device" button, which to me seems like a basic functionality. If the app decides to delete them, it will.

https://old.reddit.com/r/ios/comments/1b04rzy/apple_what_wer...

https://news.ycombinator.com/item?id=23736536

https://apple.stackexchange.com/questions/344271/books-autom...

Re:Leaking the email of any YouTube user for $10,000 by superb_dev on Wednesday February 12, 2025 @02:21PM (#43028777)
Oh okay, but that’s not what you said? You implied that no books could be downloaded at all which is just not true.

iCloud offload is a pretty common feature on Apple devices and one that I find pretty handy. I understand why it doesn’t work for others though.

You can turn off iCloud sync in general for the device.

Re:Leaking the email of any YouTube user for $10,000 by ragazzina on Wednesday February 12, 2025 @03:13PM (#43029272)
I don't think I have implied that. I have said that there's no functionality to download and keep files on device, which is true, because you cannot trust the device will not delete your files without your permission (or even without warning you first). But I'm not a native speaker so I could have been misunderstood.
Re:Leaking the email of any YouTube user for $10,000 by goldfish3 on Wednesday February 12, 2025 @11:29AM (#43026907)
There's a lot of truth to that. Older projects often get bogged down by new security & compliance horizontals, to the point where maintenance is just no longer worth it.
Re:Leaking the email of any YouTube user for $10,000 by robin_reala on Wednesday February 12, 2025 @07:13AM (#43024552)
Unfortunately with the number of users Google has, any deprecation will be met with cries of pain / I-rely-on-the-spacebar-to-heat-up-my-computer. See https://killedbygoogle.com/.
Re:Leaking the email of any YouTube user for $10,000 by aeonik on Wednesday February 12, 2025 @07:22AM (#43024629)
They really aren't shy about massive breaking changes.

I'm still upset about Google Reader.

https://killedbygoogle.com/

Re:Leaking the email of any YouTube user for $10,000 by meindnoch on Wednesday February 12, 2025 @08:17AM (#43025096)
+1 for Google Reader

That marks my coming of age on the enshittified web. The killing of Google Reader was a watershed moment. It marks the moment in time when the tide turned from the open Web to closed social media gardens.

Re:Leaking the email of any YouTube user for $10,000 by thoroughburro on Wednesday February 12, 2025 @08:12AM (#43025059)
I remember being upset about Google Reader for a few months after its death… before moving to one of its many, fuller-featured competitors and carrying on using RSS feeds exactly as before.

What upsets me re RSS these days is how many people were apparently so reliant on one reader that they still publicly mourn every time it comes up, 12 years later. Who are these fair-weather feed followers who threw their hands in the air with the loss of exactly one product?

Re:Leaking the email of any YouTube user for $10,000 by flir on Wednesday February 12, 2025 @08:27AM (#43025189)
GR had some primitive social features that none of the competitors, as far as I know, could replicate. Side-effect of being the largest. Even an exact clone wouldn't behave the same. It was the core of the blogging ecosystem, and IMO its removal was the main cause of blogging falling apart.

All so they could clear the way for Google Plus. And look how that turned out.

So yeah, watershed moment, the point where the scales fell from my eyes, still justifiably pissed, fool me twice, etc etc etc

(Still using RSS daily, though I lapsed for a while).

Re:Leaking the email of any YouTube user for $10,000 by D13Fd on Wednesday February 12, 2025 @08:30AM (#43025215)
There still is no replacement for Google Reader. The difference is that there was a community around Reader’s social features. That only really works with wide adoption, and it’s a lot easier for people to adopt a Google product than a random company x one. Today, there are many replacements with the mechanical features of browsing & sync, but the community will never come back.

The other problem was that Google killing Reader was a signal to the broader web to move away from RSS. RSS has kind of limped along since then.

Re:Leaking the email of any YouTube user for $10,000 by baud147258 on Wednesday February 12, 2025 @12:28PM (#43027524)
> The difference is that there was a community around Reader’s social features.

Are social features the main selling point of RSS readers? I mean I just use mine to know when there's a new blog post/webcomic posted on a few sites I follow, without having to give my email or use another platform like social media to know about it. And I'd use the social features which are present on the blogs, under the control of the blog owner(s), if there's any. Or maybe my use case is not the most common one?

Though I agress about the signal Google sent by killing GR.

Re:Leaking the email of any YouTube user for $10,000 by ant6n on Wednesday February 12, 2025 @09:03AM (#43025511)
Killing Google Reader killed blogs. You personally can replace Google Reader as a product, but since most people didn't and just sort of moved on to closed platforms, there was less content produced on blogs and less discussion activity on the blog posts that were created after.
Re:Leaking the email of any YouTube user for $10,000 by scarface_74 on Wednesday February 12, 2025 @10:29AM (#43026332)
John Gruber of DaringFireball has said his blog has still not recovered completely from the Google Reader shutdown and he has the most popular blog in the Apple ecosystem
Re:Leaking the email of any YouTube user for $10,000 by jfengel on Wednesday February 12, 2025 @08:09AM (#43025032)
I didn't use Reader. What was so special about it? Iirc it was an RSS aggregator, which sounds pretty simple to replace. Nobody has an open source equivalent?
Re:Leaking the email of any YouTube user for $10,000 by myrion on Wednesday February 12, 2025 @08:12AM (#43025055)
Great and simple UI, synced across all your devices (which is what ended up killing RSS in f.ex. Thunderbird for me).
Re:Leaking the email of any YouTube user for $10,000 by kobalsky on Wednesday February 12, 2025 @08:19AM (#43025117)
There wasn't an equivalent when it was deprecated. It downloaded the contents and they were archived in your account.

https://news.ycombinator.com/item?id=5371982

Re:Leaking the email of any YouTube user for $10,000 by EA on Wednesday February 12, 2025 @08:57AM (#43025457)
Re:Leaking the email of any YouTube user for $10,000 by Y_Y on Wednesday February 12, 2025 @07:46AM (#43024852)
Many of us are still upset about Reader. It definitely felt like a watershed moment between the old cool Google who sent pizzas to hackers and had clean fast web design and weren't evil.

I'd be so glad now to give up on Google and all its enshittified shit. I could give up things that are still super useful and I get value from every day: YouTube, Gmail, Play Services, Drive, Maps. But I don't think I could give them all up at once. I've been trying to migrate to Proton and OpenStreetMap and some kind of real Linux phone etc, I don't even mind if I have to fiddle around before everything works. The trouble is that the claws are in, but they're not in me.

Remember when Google proudly didn't advertise themselves? They got to critical mass through word of mouth, from having a compellingly better product. Now what they have is network effects and locking. They used to appeal to developers and techies because and that ended up making the services better for everyone. Now like all the other tech giants they have PHB's optimizing for the next millisecond of attention and Microdollar of ad revenue from a lowest-common-denominator victim.

Google is so big that it's a significant part of life for a significant proportion of the world. When Google is shit it moves the needle on net human suffering. I think the UN should be focussing on prevent war and trying to salvage our environment, but if they aren't going to do that then it might be rational to just form a worldwide consumer group to take on megacorps.

Re:Leaking the email of any YouTube user for $10,000 by DonHopkins on Wednesday February 12, 2025 @08:20AM (#43025123)
I'm still upset about the "I've Got A Bad Feeling About This" button.

https://www.youtube.com/watch?v=4Z4RKRLaSug

Re:Leaking the email of any YouTube user for $10,000 by ibaikov on Wednesday February 12, 2025 @08:31AM (#43025230)
I realized I was reading too many websites and decided to switch to RSS, only to find out that Google had killed Reader a month earlier.

Years later, I came across Artifact, created by the founders of Instagram, and thought it was an interesting idea. The problem was I was reading its shutdown announcement.

Sometimes I think products are killed way too early. Look at twitch, it boomed after years of stagnation.

Re:Leaking the email of any YouTube user for $10,000 by robertlagrant on Wednesday February 12, 2025 @08:56AM (#43025447)
Twitch has found some not-amazing niches to bulk up its revenue. A service needs to be profitable to work, and I don't think anyone wanted to pay for RSS. Or not enough.
Re:Leaking the email of any YouTube user for $10,000 by ibaikov on Wednesday February 12, 2025 @11:38AM (#43027007)
Somewhat true back then, but I think now there are more people who would pay for it, and they could capitalize a lot on integrating LLMs into RSS apps.
Re:Leaking the email of any YouTube user for $10,000 by robertlagrant on Wednesday February 12, 2025 @12:21PM (#43027439)
By comparison, Twitch's yearly revenue is consistently over $100m[0] from subscriptions and other in-app payments (e.g. taking a cut for buying their internal currency).

[0] https://www.statista.com/statistics/517907/twitch-app-revenu...

Re:Leaking the email of any YouTube user for $10,000 by ramon156 on Wednesday February 12, 2025 @07:19AM (#43024597)
Side note, what is that reference from? Searching "i rely on the spacebar to heat up my computer" directs me back to this comment (6 mins ago).
Re:Leaking the email of any YouTube user for $10,000 by croisillon on Wednesday February 12, 2025 @07:36AM (#43024754)
you're one of today's lucky 10,000
Re:Leaking the email of any YouTube user for $10,000 by Y_Y on Wednesday February 12, 2025 @07:47AM (#43024867)
Re:Leaking the email of any YouTube user for $10,000 by cfreksen on Wednesday February 12, 2025 @07:20AM (#43024608)
It is a reference to the following XKCD comic: https://xkcd.com/1172/
Re:Leaking the email of any YouTube user for $10,000 by klabb3 on Wednesday February 12, 2025 @07:21AM (#43024617)
Re:Leaking the email of any YouTube user for $10,000 by mjgant on Wednesday February 12, 2025 @07:21AM (#43024611)
Re:Leaking the email of any YouTube user for $10,000 by hkwerf on Wednesday February 12, 2025 @07:21AM (#43024615)
You're essentially suggesting a Drake equation [1] equivalent for the number of security vulnerabilities based on NLoC. What other factors would be part of this equation?

[1] https://en.wikipedia.org/wiki/Drake_equation

Re:Leaking the email of any YouTube user for $10,000 by maximus-decimus on Wednesday February 12, 2025 @07:29AM (#43024700)
How close to the Balmer peak the programmer was when he wrote the code.
Re:Leaking the email of any YouTube user for $10,000 by bobnamob on Wednesday February 12, 2025 @08:17AM (#43025097)
Correlated or inversely correlated?
Re:Leaking the email of any YouTube user for $10,000 by CSMastermind on Wednesday February 12, 2025 @08:44AM (#43025334)
Language or framework definitely plays a role (isn't that what the Rust people are so excited about). Maybe say like the materials/tools used.

There's definitely some measure of complexity. I still like simple cyclomatic but I know there are better ones out there that try to capture the cognitive load of understanding the code.

The attack surface of the system is definitely important. The more ways that more people have to interface with the code, the more likely it is that there will be a mistake.

Security practices need to be captured in some way (maybe a factor that gets applied). If you have vulnerability scanning enabled that's going to catch some percentage of bugs. So will static analysis, code reviews, etc.

Re:Leaking the email of any YouTube user for $10,000 by zwnow on Wednesday February 12, 2025 @07:48AM (#43024877)
The point is: security is fake. No app is truly secure. You can spend millions on app security and all it takes to breach that is one slip up of a human user.
Re:Leaking the email of any YouTube user for $10,000 by TheDong on Wednesday February 12, 2025 @08:08AM (#43025025)
I'd take away "security is complicated and multi-faceted", not "fake".

It's not a black and white of "an app is truly secure" or "an app is truly insecure", but rather a continuum from "secure enough in practice for this threat model and purpose" to "an insecure mess".

Like, plenty of websites and apps have launched, existed for years, and then shutdown without a single security incident. In those cases, surely the app was secure, right? At least secure enough? Signal so far has been "secure enough in practice" for most people, while iMessage has in practice been "secure enough if you're a normal person, but with serious security issues for anyone who might be subject to serious targeted attacks"

Say more about what you mean by "no app is truly secure"? Especially in the context of signal?

Re:Leaking the email of any YouTube user for $10,000 by zwnow on Wednesday February 12, 2025 @08:29AM (#43025212)
Im just saying that all it takes is one employee to click onto the wrong URL to breach your apps security. I am not talking about the app itself. You can have all the security implemented the world has to offer and yet you cant get rid of human errors.
Re:Leaking the email of any YouTube user for $10,000 by TheDong on Wednesday February 12, 2025 @08:34AM (#43025261)
I'm totally not understanding what you're saying then.

> Im just saying that all it takes is one employee to click onto the wrong URL to breach your apps security

Pretend I'm a signal employee. What link can I click that breaches the app's security?

They don't store unencrypted data, pushing source code changes requires review, releases are signed and a single employee can't compromise the release process, so I'm missing how one employee being compromised could lead to the signal app breaching signal's security.

Also, in practice, how often are apps compromised from a phishing attack? I don't even really see news reports on that, so I'm curious if you're operating off like a specific case or something.

Re:Leaking the email of any YouTube user for $10,000 by zwnow on Wednesday February 12, 2025 @08:38AM (#43025288)
Some malicious mail that grants remote access to the employees device? Its not that hard to understand.
Re:Leaking the email of any YouTube user for $10,000 by dboreham on Wednesday February 12, 2025 @09:42AM (#43025853)
Actually it is hard to understand because that employee's device isn't an attack vector.
Re:Leaking the email of any YouTube user for $10,000 by zwnow on Wednesday February 12, 2025 @11:04AM (#43026690)
It absolutely is. Every connection to your app also is a attack vector.
Re:Leaking the email of any YouTube user for $10,000 by vladms on Wednesday February 12, 2025 @08:27AM (#43025190)
I would challenge you to give me examples where security feels "real" and how does that help.

Most software products rely on very complex software stacks, and if you trust 100% all the libraries and the OS you use I would say it's a wrong mindset. There were bugs even in the processor (meltdown). Security is a continuous battle and you never know if you won, only (sometimes) if you loose.

Re:Leaking the email of any YouTube user for $10,000 by tialaramex on Wednesday February 12, 2025 @08:48AM (#43025375)
You can tell security is real the same way as lots of other things, reality doesn't give a fuck. Like how you can tell the difference between man's laws (e.g. "The Offside Rule" or "Constitutional Rights") and Mother Nature's laws (e.g. Thermodynamics). Try it, kick the ball even though the rule says you mustn't - if you get lucky the referee doesn't notice and play continues. But if you try to make a system more ordered without expending energy it does not work. Reality doesn't give a fuck.

When I breeze through your login process with the wrong credentials that's because your security was fake, if it was real that would break because it didn't know who I was, so if some bug lets me past login I don't somehow successfully log in as me, I'm logging in as nobody at all which is clearly nonsense.

This is "Make Invalid States Unrepresentable" at scale, and it's difficult to do, but not impossible.