ijcd

No paywall: https://web.archive.org/web/20220529214915/https://nymag.com...

Yup, and AWS Code*

Typescript/React and Go. Ruby and Ember once upon a time.

100s of services and databases to work out and sort through. Good luck building a global real-time video CDN too. You could build your own faster. Microservice architectures mirror the org that built them. You wouldn’t do it the same way for yourself.

In general the broad access was to code repos early on. Some were gated. There’s lots of collaboration and the need to study other code bases for learning and collaboration, read only. It’s micro services galore there so one didn’t tend to have access to production databases for services or systems you didn’t work on. You were opted in there. Teams did their own devops for the most part.

The payout data likely wasn’t ripped from a DB but rather dashboards which customer service or partnerships likely had access to. Tier1 or Tier2 support kinda stuff.

This smells like a stolen backup or maybe network access and http scanning, finding the internal GitHub and maybe a support admin cred that allowed dashboard view.

X

The extractors directory had 765 extractors in it, only one of which is YouTube. The facts seem cherry-picked to support their case (well duh). Hopefully that will matter. Given that youtube is a tenth of a percent of the extractors maybe there's hope.

FWIW, it's easy to find the code on Google. The release tarballs have the format youtube-dl-YYYY.MM.DD.tar.gz and one can look in the Homebrew Cellar, for example and see there was a release on 2020.09.20. ;)

Can’t be certain that no one has copied the unencrypted user’s data either.

My favorite approach is encrypting all of a user’s data (everywhere) and just deleting the key from a central store instead of actually erasing.

That was done too, of course. There’s so much to get done in these big systems that it’s often most efficient to take the quick win and move on, especially when, as I mentioned, the world is expected to fix the problem for you for free.

We had internal discussions around the "hacky" nature of the solution. Both sides had proponents. The proof was in the numbers and some teams utilized it, others did not. In the end it was a few-line solution that solved the problem neatly and didn't rely on a (terrifying) dynamic solution such as is proposed in this blog post. It was expected the "hack" would be temporary as we expected the Go GC to quickly improve to the point it was not necessary.

The title is misleading. I did a science project on this in the early 1990s. The paper mentions that the retention of memories after decapitation has been known since the 1950s. The news here seems to be that they have developed a computerized system to allow for easier, more consistent study of this phenomenon. This reminds me of Feynman's Cargo Cult of Science essay where he talks about the research that went into how to research rats, and why that was good science that many others ignored.