HNNewShowAskJobs
Built with Tanstack Start
SmartTube Compromised(aftvnews.com)
83 points by akersten 6 hours ago | 56 comments
  • boje2 hours ago

    I really hope Google doesn't pick this out (and similar events) as further justification for getting rid of APK-based installation.

  • GaryBluto3 hours ago

    It's kind of shocking to me that so many people would download an app like this and sign in using their actual YouTube account.

    • retSava2 hours ago |parent

      It's not just cost and ads. It's having the possibility to reduce attempts to manipulate my inner reptile brain. With various clients, you can disable shorts, recommended, you have sponsorblock, you can replace youtube-face-thumbs with actual thumbs and get crowd-sourced titles that better reflect the contents.

      I also don't need to manually go set speed to 1.75x and enable subs in english, it's a one-time setting. _Further_ I can download a video locally, for whatever reason (later viewing, bw throttling, risk of deletion, etc).

      As if that weren't enough, I don't have to watch videos logged in, my client is just set up to download my select channels.

      I now see zero use of a youtube account.

    • dottjt3 hours ago |parent

      I think it's more shocking to people how much YouTube Premium costs.

      • M4v3R3 hours ago |parent

        Is $14 dollars for ad-free, unlimited access to literally billions of videos really a steep price? Personally if I were to get rid of all but one of my media subscriptions I would stick with this one, since it's got everything - entertainment, education, inspiration, you name it.

        • homebreweran hour ago |parent

          $14 is two days worth of living in my country for your average man on the street, among many other similar places. Imagine if you had to pay $200 to watch YouTube, that's how much these services cost for us.

          They refuse to correct for purchasing power parity and are left with nothing in the end. Steam seems to do very well in comparison.

          (I don't watch YouTube even for free, but practically everybody I know does without paying anything, and it makes a lot of sense).

        • graemep2 hours ago |parent

          I am not going to watch billions of Videos.

          Its not entirely ad free, just fewer ads, AFAIK sponsored segments remain so there are still ads, sometimes quite lengthy ones.

          $14/month is $168 an year, and if you subscribe to multiple other video services the annual total is going to be quite high.

          • cyberaxan hour ago |parent

            SponsorBlock helps with them.

        • dottjt2 hours ago |parent

          When the alternative is the exact same thing you describe but for $0 dollars, then yes.

        • podgietaru3 hours ago |parent

          Not to mention included YouTube Music. It's one of the few subs I pay for, because I watch a _lot_ of YouTube on the TV. And also like to have it in the background for "Podcast" style videos where the video is really only an accompaniment.

          • microtonal9 minutes ago |parent

            That's actually worse. They used to have a separate YouTube subscription. I don't want (to pay for) YouTube Music, because I already have Apple Music and Tidal, which I prefer.

        • RobotToaster18 minutes ago |parent

          For something that was previously free with only unintrusive ads, yes.

        • spaqin3 hours ago |parent

          That's extremely subjective, but I'd rather save that $14 a month towards retirement. And if YouTube was only available with ads... well, that's no videos for me, maybe for the better, I would waste less time.

          • didntcheck2 hours ago |parent

            Sure, and you're free to

            1. Save $14 for retirement and not watch Youtube

            2. Save $14 for retirement and watch Youtube with ads

            3. Pay $14 a month for Youtube without ads

            The only option that's not fair is expecting private companies and creators to give you entertainment and its delivery with nothing in return

            • malka19862 hours ago |parent

              Google is free to block me / my IP / ban my account.

            • conspan hour ago |parent

              Google uses your data and habits for profit. Dont pretend it's free.

          • GoblinSlayeran hour ago |parent

            I get cat videos through messengers.

        • ManlyBread31 minutes ago |parent

          $14 and I still have to run several plugins just to make the site actually usable. No thanks.

        • londons_explore3 hours ago |parent

          14 dollars a month for a decade is $1680.

          To save $1680 I'd prefer to just use an adblocker (which I have done for the past decade)

          • hhh2 hours ago |parent

            Yes, and you choose to risk losing the most important platform to humanity next to Wikipedia. Youtube should be a public service.

            • graemep2 hours ago |parent

              I am dubious about the importance of Youtube. If it disappeared tomorrow how long would it take for most videos to reappear elsewhere? Some of the creators I watch do have the videos available elsewhere. Veritasium is on Odysee, lots of people are on Nebula (and release videos there that are not on Youtube), etc.

              I think there is a good argument that having a single dominant platform has been harmful.

            • Rastonburyan hour ago |parent

              Insane hyperbole here, this guy's adblock = risking humanity losing it's 2nd most important platform owned by one of the most profitable companies in the world

              OpenAI thought of it first, should YouTube get a government backstop too?

            • latexran hour ago |parent

              Let’s not get too hasty comparing YouTube to Wikipedia. Maybe what you watch on YouTube is interesting and educational, but let’s not forget it’s also a major platform for misinformation, propaganda, conspiracy theories, radicalisation, scams…

            • NaomiLehman2 hours ago |parent

              YouTube wouldn't exist as a public service. there would be no incentive to make videos

              • Kbelicius9 minutes ago |parent

                Why wouldn't there be incentives? If you are thinking monetary then the existence of youtube disproves your statement.

        • StopDisinfo91017 minutes ago |parent

          That's a very generous characterization of what most YouTube content is.

          My experience is that you are basically paying to remove the official ads from your disguised ads.

          The various algorithm tweaks for engagement these past few years and the introduction of shorts have significantly degraded the content quality and many good channels have just thrown the towel.

        • krige3 hours ago |parent

          >ad-free

          hasn't been in over a year

          • Wilya2 hours ago |parent

            Youtube premium is still ad-free. There is a Youtube premium lite which is kinda-ad-free-but-not-really, but the full ad-free one still exists.

            • tcfhgj2 hours ago |parent

              youtube premium has sponsorblock integrated now?

              • fragmedean hour ago |parent

                basically, yeah. there's a white fast forward button that appears during frequently fast forwarded sections, which unsurprisingly happens to be sponsor sections.

          • denkmoon3 hours ago |parent

            ??? I've been on youtube premium / redtube since the beginning and I've been served 1 ad incorrectly in that time.

            • rkomorn3 hours ago |parent

              > YouTube premium / redtube

              I just googled redtube and uh... are you sure?

              • codeflo2 hours ago |parent

                YouTube Premium was originally called YouTube Red. Grandparent poster may have made a Freudian slip. :)

                • rkomorn2 hours ago |parent

                  I know, I was just being... sassy. Partly because I didn't actually need to google it.

              • fragmede2 hours ago |parent

                YouTube Red was the previous name of YouTube Premium, probably renamed because of the unfortunate name clash you just noticed.

        • tcfhgj2 hours ago |parent

          $14 dollars better spent on liberapay

        • malka19862 hours ago |parent

          I hate google, and I refuse to give them any money.

    • tcfhgj3 hours ago |parent

      I really couldn't care less about me youtube account

      • impulsivepuppet3 hours ago |parent

        I can't help but think that this is a "I have nothing to hide" argument. It's quite sisyphean to keep accounts perfectly segregated, therefore there's always a chance that personal information can be traced back and pieced together; which, in turn, has "boring-old security" implications: i.e., now someone possibly knows your habbits and times when you are at work

        • tcfhgj2 hours ago |parent

          my "personal" information there is as personal as my profile here

      • GaryBluto3 hours ago |parent

        YouTube accounts and Google accounts have been one in the same since 2009.

        • defrost2 hours ago |parent

          Many people have had multiple gmail accounts since 2004.

          I have a gmail account used solely for google store and Android TV related verifications that's unlike other business, personal, registration, or spam email accounts.

          The TV's in the house, smart wifi devices, and guest wifi accounts are on separate subnets, the NAS hosted media has limited read only keyhole access accounts for TV apps to use.

          Whether it's SmartTube or any other app (iView, SBSOnline, Netflix, etc) it's wise to assume that anyone can be comprised by malware to sniff traffic for (say) bank account passwords, host bots for DDOS or mining, etc.

        • lan3212 hours ago |parent

          Obligatory call to free yourselves from having GMail as your (only) main email and especially to not tie it to YT or other unrelated services.

          I can absolutely imagine my YT accounts at some point getting banned for using adblock, some stupid private upload or some comment.

          • temp0826an hour ago |parent

            Having your own domain name is the best option (ideally not hosting on gsuite!)

        • VerifiedReportsan hour ago |parent

          one AND the same

        • tcfhgj2 hours ago |parent

          how does this matter?

          • homebreweran hour ago |parent

            You risk losing your entire Google account along with all documents, photos, mail, and whatever else you have there. Enough stories of this happening if you look around.

  • breakingcups2 hours ago

    The official announcement is very sparse on details. If the developer doesn't know how his digital signature (and update infrastructure?) was compromised, how does switching to a new signature help? It could get compromised in the exact same way.

  • hollow-moe4 hours ago

    That's exactly why I didn't want to trust this app with a google account, it's mandatory to use it. SmartTube also requires permission to install applications for it's updater feature so it's also possible if the attack was targeted for the malware to install another app to get persistance.

    • XiS4 hours ago |parent

      Although it's very unfortunate this happened, and it shows a lack of security practices, this could happen to any all developer. Compromising other apps you do install.

      On my TV the app vanished and after some searching, it was disabled. I was kinda afraid Google had finally (ab)used it's Play Services power to ban it. But luckily it was because the developer marked it as compromised. All and all impact was minimised this way.

      I doubt your statement about requiring a Google account to be connected, as you can also import subscriptions instead of granting access to your account.

    • kasabali3 hours ago |parent

      > it's mandatory to use it

      I've been using it for years and I've never had to sign in.

  • reassess_blindan hour ago

    What can malware in an apk do?

  • avereveardan hour ago

    Really hate this "something was found" announcements

    Which channel distributed the compromised apk? What is the signature of the payload injected? What is the payload, what does it do?

  • nubinetwork3 hours ago

    In an article about not downloading malware: "You can use my downloader! It's totally safe, bro!"

    Yeah, I'll pass.

    • Algent3 hours ago |parent

      The internal auto updater of the app directly use github as source, was this also compromised ? If malware was only on some random apkmirror upload then it should probably be fine for most users.

    • jve3 hours ago |parent

      I think this comment relates to the fact that article mentions AFTNews Updater app as a way to install SmartTube... not yet released version of software?