How I could delete any video on YouTube

http://kamil.hism.ru/posts/about-vrg-and-delete-any-youtube-video-issue.html

by mukyu • 11 years ago

186 34 11 years ago

kamil.hism.ru

xmm8• 11 years ago

Now that's a critical bug.

scrapcode2• 11 years ago

Absolutely critical. And he got $5k? Glad his ethics are sound.

dsacco2• 11 years ago

This bug is probably worth about that much. It was a good find, however.

fffrad• 11 years ago

It's the littlest bugs that do the most harm. Bieber got lucky this time.

mariojv• 11 years ago

Avast blocked this site for having malware. Is this false detection or is there actually malware on the site?

ars• 11 years ago

Looks false to me. Only script I don't recognize is "uptolike.com".

aw3c2• 11 years ago

No one can know what you got served.

kamilhism2• 11 years ago

False positive. Wrote about it to Avast 6 months ago, but they did not reply =/

superasn• 11 years ago

I remember last year someone discovered a very similar bug in Google's Webmaster tool that would let any person remove any site from Google's search results[1]. It's a wonder that bugs such as this are there in Google's site.

[1] http://searchengineland.com/google-disables-url-removals-aft...

raz32dust• 11 years ago

I don't think we should correlate the reward with the impact of the bug. Going that route, even 20k is not really enough.

rjaco31• 11 years ago

I don't see your point. If such a vuln could cause damage massively bigger than 20k, why is it so stupid to reward the one who found it with a corresponding amount?

logicallee• 11 years ago

if a bug is found that can do $1 billion of damage to Google (easy to imagine, they operate at a huge scale) would you expect it to be worth any significant percentage of that? at some point incentives stop scaling.

mmahemoff• 11 years ago

I actually agree $20K would seem fairer here, but to answer your question, one reason it may not correlate closely is that you're only referring to the demand side, ie how valuable is this discovery to Google?

The compensation level also comes down to the supply side - how many other people might have discovered this bug shortly after this?

For this reason, there's probably a good argument to increase the reward according to how long the vulnerability was present, to the extent that's knowable. (More so with an open source libraries under version control than a website.)

swframe• 11 years ago

Like other serious business flaws (e.g. the GM key ignition bug), companies weigh the risks and can conclude that it is cheaper to respond the problem than to fix it proactively. As a result, should the government require businesses with sensitive data to implement bug bounties?

smt883• 11 years ago

As a result, should the government require businesses with sensitive data to implement bug bounties?

No. They should go further. We should have a law, similar to Sarbanes-Oxley, that forces companies to undergo a security audit every year.

Otherwise, we're going to be in an endless cycle, where companies refuse to invest in security, a huge breach occurs, and everyone suffers.

The current system does not incentivize investments in security because they hurt the bottom line and have no tangible, immediate value to shareholders. That's a dangerous situation.

icebraining2• 11 years ago

Having read about multiple "security audits" done by under the PCI-DSS and similar mandates, my faith in their effectiveness is pretty low. This is an (admittedly extreme) example: http://serverfault.com/questions/293217/our-security-auditor...

I'd rather see some security standards (updated yearly or so) and heavy fines and reimbursements after an hack (not necessarily malicious - proof of concept published by a white hacker would do), if the security was lax. Triple them if the company hid the fact that they had been hacked.

jacquesm• 11 years ago

The only thing that will do is kill a ton of small time websites.

nahushrk• 11 years ago

While it would be great for him to get paid more than 5k for such high nuisance value bug, it'll be a bit difficult to figure out a metric to fairly put a price on a bug. Bug bounties are based on efforts and not on what you happen to find. Its like a lottery and it seems just about right for companies to keep a standard reward for all bugs. I really like the idea of paying for time spent+bug reward though.

TomGullen• 11 years ago

People saying he should of gotten more than $5k, it sounds like he accepted a decent sum just to spend time looking with no requirement to find bugs! To me, that sounds like he was compensated fairly from the go and any extra is just a bonus.

towelguy• 11 years ago

Facebook payed $12500 for a bug that could delete albums:

http://www.7xter.com/2015/02/how-i-hacked-your-facebook-phot...

NietTim• 11 years ago

Yeah...He spent 6~7 hours on it. Seems like a fair deal to me. Others suggest he should have deleted all JB's videos because it would have been more rewarding then getting 5K. Guess they forgot about the attached jail time with that one.

How I could delete any video on YouTube

Related Stories