Remix.run Logo
SmartTube Compromised(aftvnews.com)
75 points by akersten 5 hours ago | 45 comments
boje an hour ago | parent | next [-]

I really hope Google doesn't pick this out (and similar events) as further justification for getting rid of APK-based installation.

GaryBluto 2 hours ago | parent | prev | next [-]

It's kind of shocking to me that so many people would download an app like this and sign in using their actual YouTube account.

retSava an hour ago | parent | next [-]

It's not just cost and ads. It's having the possibility to reduce attempts to manipulate my inner reptile brain. With various clients, you can disable shorts, recommended, you have sponsorblock, you can replace youtube-face-thumbs with actual thumbs and get crowd-sourced titles that better reflect the contents.

I also don't need to manually go set speed to 1.75x and enable subs in english, it's a one-time setting. _Further_ I can download a video locally, for whatever reason (later viewing, bw throttling, risk of deletion, etc).

As if that weren't enough, I don't have to watch videos logged in, my client is just set up to download my select channels.

I now see zero use of a youtube account.

dottjt 2 hours ago | parent | prev | next [-]

I think it's more shocking to people how much YouTube Premium costs.

M4v3R an hour ago | parent [-]

Is $14 dollars for ad-free, unlimited access to literally billions of videos really a steep price? Personally if I were to get rid of all but one of my media subscriptions I would stick with this one, since it's got everything - entertainment, education, inspiration, you name it.

dottjt an hour ago | parent | next [-]

When the alternative is the exact same thing you describe but for $0 dollars, then yes.

graemep 20 minutes ago | parent | prev | next [-]

I am not going to watch billions of Videos.

Its not entirely ad free, just fewer ads, AFAIK sponsored segments remain so there are still ads, sometimes quite lengthy ones.

$14/month is $168 an year, and if you subscribe to multiple other video services the annual total is going to be quite high.

cyberax 2 minutes ago | parent [-]

SponsorBlock helps with them.

podgietaru an hour ago | parent | prev | next [-]

Not to mention included YouTube Music. It's one of the few subs I pay for, because I watch a _lot_ of YouTube on the TV. And also like to have it in the background for "Podcast" style videos where the video is really only an accompaniment.

spaqin an hour ago | parent | prev | next [-]

That's extremely subjective, but I'd rather save that $14 a month towards retirement. And if YouTube was only available with ads... well, that's no videos for me, maybe for the better, I would waste less time.

didntcheck 30 minutes ago | parent [-]

Sure, and you're free to

1. Save $14 for retirement and not watch Youtube

2. Save $14 for retirement and watch Youtube with ads

3. Pay $14 a month for Youtube without ads

The only option that's not fair is expecting private companies and creators to give you entertainment and its delivery with nothing in return

consp 11 minutes ago | parent | next [-]

Google uses your data and habits for profit. Dont pretend it's free.

malka1986 18 minutes ago | parent | prev [-]

Google is free to block me / my IP / ban my account.

londons_explore an hour ago | parent | prev | next [-]

14 dollars a month for a decade is $1680.

To save $1680 I'd prefer to just use an adblocker (which I have done for the past decade)

hhh 29 minutes ago | parent [-]

Yes, and you choose to risk losing the most important platform to humanity next to Wikipedia. Youtube should be a public service.

latexr 2 minutes ago | parent | next [-]

Let’s not get too hasty comparing YouTube to Wikipedia. Maybe what you watch on YouTube is interesting and educational, but let’s not forget it’s also a major platform for misinformation, propaganda, conspiracy theories, radicalisation, scams…

graemep 15 minutes ago | parent | prev | next [-]

I am dubious about the importance of Youtube. If it disappeared tomorrow how long would it take for most videos to reappear elsewhere? Some of the creators I watch do have the videos available elsewhere. Veritasium is on Odysee, lots of people are on Nebula (and release videos there that are not on Youtube), etc.

I think there is a good argument that having a single dominant platform has been harmful.

Rastonbury 14 minutes ago | parent | prev | next [-]

Insane hyperbole here, this guy's adblock = risking humanity losing it's 2nd most important platform owned by one of the most profitable companies in the world

OpenAI thought of it first, should YouTube get a government backstop too?

NaomiLehman 19 minutes ago | parent | prev [-]

YouTube wouldn't exist as a public service. there would be no incentive to make videos

tcfhgj 38 minutes ago | parent | prev | next [-]

$14 dollars better spent on liberapay

krige an hour ago | parent | prev | next [-]

>ad-free

hasn't been in over a year

Wilya an hour ago | parent | next [-]

Youtube premium is still ad-free. There is a Youtube premium lite which is kinda-ad-free-but-not-really, but the full ad-free one still exists.

tcfhgj 37 minutes ago | parent [-]

youtube premium has sponsorblock integrated now?

denkmoon an hour ago | parent | prev [-]

??? I've been on youtube premium / redtube since the beginning and I've been served 1 ad incorrectly in that time.

rkomorn an hour ago | parent [-]

> YouTube premium / redtube

I just googled redtube and uh... are you sure?

codeflo an hour ago | parent | next [-]

YouTube Premium was originally called YouTube Red. Grandparent poster may have made a Freudian slip. :)

rkomorn an hour ago | parent [-]

I know, I was just being... sassy. Partly because I didn't actually need to google it.

fragmede an hour ago | parent | prev [-]

YouTube Red was the previous name of YouTube Premium, probably renamed because of the unfortunate name clash you just noticed.

malka1986 an hour ago | parent | prev [-]

I hate google, and I refuse to give them any money.

tcfhgj 2 hours ago | parent | prev [-]

I really couldn't care less about me youtube account

impulsivepuppet an hour ago | parent | next [-]

I can't help but think that this is a "I have nothing to hide" argument. It's quite sisyphean to keep accounts perfectly segregated, therefore there's always a chance that personal information can be traced back and pieced together; which, in turn, has "boring-old security" implications: i.e., now someone possibly knows your habbits and times when you are at work

tcfhgj 42 minutes ago | parent [-]

my "personal" information there is as personal as my profile here

GaryBluto an hour ago | parent | prev [-]

YouTube accounts and Google accounts have been one in the same since 2009.

defrost an hour ago | parent | next [-]

Many people have had multiple gmail accounts since 2004.

I have a gmail account used solely for google store and Android TV related verifications that's unlike other business, personal, registration, or spam email accounts.

The TV's in the house, smart wifi devices, and guest wifi accounts are on separate subnets, the NAS hosted media has limited read only keyhole access accounts for TV apps to use.

Whether it's SmartTube or any other app (iView, SBSOnline, Netflix, etc) it's wise to assume that anyone can be comprised by malware to sniff traffic for (say) bank account passwords, host bots for DDOS or mining, etc.

VerifiedReports 3 minutes ago | parent | prev | next [-]

one AND the same

lan321 an hour ago | parent | prev | next [-]

Obligatory call to free yourselves from having GMail as your (only) main email and especially to not tie it to YT or other unrelated services.

I can absolutely imagine my YT accounts at some point getting banned for using adblock, some stupid private upload or some comment.

temp0826 a minute ago | parent [-]

Having your own domain name is the best option (ideally not hostingon gsuite!)

tcfhgj an hour ago | parent | prev [-]

how does this matter?

breakingcups an hour ago | parent | prev | next [-]

The official announcement is very sparse on details. If the developer doesn't know how his digital signature (and update infrastructure?) was compromised, how does switching to a new signature help? It could get compromised in the exact same way.

hollow-moe 3 hours ago | parent | prev | next [-]

That's exactly why I didn't want to trust this app with a google account, it's mandatory to use it. SmartTube also requires permission to install applications for it's updater feature so it's also possible if the attack was targeted for the malware to install another app to get persistance.

XiS 3 hours ago | parent | next [-]

Although it's very unfortunate this happened, and it shows a lack of security practices, this could happen to any all developer. Compromising other apps you do install.

On my TV the app vanished and after some searching, it was disabled. I was kinda afraid Google had finally (ab)used it's Play Services power to ban it. But luckily it was because the developer marked it as compromised. All and all impact was minimised this way.

I doubt your statement about requiring a Google account to be connected, as you can also import subscriptions instead of granting access to your account.

kasabali 2 hours ago | parent | prev [-]

> it's mandatory to use it

I've been using it for years and I've never had to sign in.

nubinetwork 2 hours ago | parent | prev [-]

In an article about not downloading malware: "You can use my downloader! It's totally safe, bro!"

Yeah, I'll pass.

Algent 2 hours ago | parent | next [-]

The internal auto updater of the app directly use github as source, was this also compromised ? If malware was only on some random apkmirror upload then it should probably be fine for most users.

jve an hour ago | parent | prev [-]

I think this comment relates to the fact that article mentions AFTNews Updater app as a way to install SmartTube... not yet released version of software?