correct! Basic idea is to show how easy it is to use this simple redirect against users of social media sites. Most people on HN would have seen this link and trusted it to be from YouTube.
If a browser sees an encoded URL in the query string, and then gets a location header to go to that URL, and that URL is not on the same domain, it would prompt the user that you are leaving that domain.
I can't see many sites that are legitimate, and use redirection techniques that meet all of my criteria.
http://voice.google.com/?r=google.com/voice, where the resulting URL is inside the query_string
(Can anyone think of downsides to limiting yourself to relative URLs or a whitelist of domains?)
It is very interesting that Youtube has this vulnerability. Almost every time I implement something like this, I double check the domain name. (This is really easy in PHP)
http://news.ycombinator.com/item?id=1259844 for the google.com URL