Hacker News Reader

Comment by saagarjha | Hacker News Reader

From what it looks like, this is quite literally the ability to get code into the main codebase with no oversight. Even without malicious intentions, it seems very easy to do something awful by accident.

View on HN

The main codebase... of a video sharing site. With no SLAs, and (at the time) no partner video-hosting agreements.

The most awful thing that could happen to 2006-era YouTube: they could stop delivering ad impressions for an hour or two. Oh wait, no; 2006-era YouTube didn't even have ads yet.

I suppose more awful thing could be an accidental XSS or other vulnerability.

Which would then compromise what? People's youtube accounts?

IE6 had plenty of nasty vulns by the time this banner had gone up (06/14/2009): https://www.cvedetails.com/vulnerability-list/vendor_id-26/p...

That said, the people with this access probably knew WTF they were doing.

Exactly. They were getting rid of IE6

As opposed to the denial of service style bugs like an empty src element in an img tag?

They're perfectly capable of introducing other DOS bugs that don't depend on bad markup.

This is a poor argument - just because we can shoot our own feet, doesn't mean we should not try to prevent it from happening by accident.

And it sounds like it wasn't just DOS - also just plain "it doesn't work in ie6" seems the most likely outcome; crashes and DOS that the article describes just sounds like the most egregious cases.

This is why I like to work at small businesses, where I'm either the only developer or one of just a few. Even with annual turnovers, through the website, of approaching $10million/year (in my current and last role) there is very little oversight of what I do - there's literally no-one to challenge me on a technical level. That doesn't mean I abuse my position, but it does give me a lot of technical freedom in how I create the functionality the business asks for.

Reminds me of Marx's Alienation of the worker from their product.

of course there was oversight. Those with experience had privileged access. Basically meritocracy. Today innovation and movement is stiffled by large corprate and legal structures where engineers only recieve commands.

This must not be such a strange ability? Even at ‘big enterprise corp’ we have the ability (though not necessarily approval) to push directly to master, and I doubt there’s more restrictions in smaller companies.

It's not like there was no oversight. As noted in the article, their boss was in on it, and "the rest of us leveraged our OldTuber status to approve the code review." so there was review. They short-circuited a number of the usual steps, but it's not like there was a single person who made all the decisions.

Reply on news.ycombinator.com