9 ms·

It's a fascinating tech story, but it would easily turn into a horror if we weren't talking about something like a video hosting platform. Imagine working at a

by ljm 8y ago

It's a fascinating tech story, but it would easily turn into a horror if we weren't talking about something like a video hosting platform. Imagine working at a medical or financial company and having secretive 'old timer' permissions that basically backdoored the company's engineering processes. Even if the engineers saw a good reason to do so. I mean, who are we to say that this was doing it right? It turned out to be beneficial but there are thousands of ways that this could explode in your face if you tried it yourself.

jrochkind1 8y ago
Yes. I love the story, and if I had been in charge I don't see how I could do anything but fire the whole lot of them. Although... the number of people involved in the "OldTubers" backdoor seems to have been pretty substantial, I don't know if they could really have fired all of them... But who is anyone to say if doing anything is "right"? We're all equally qualified to have a moral compass.
- derefr 8y ago
  I mean, Google just paid a ton of money to acquihire this team, and then the acquihired team is going to turn around and fire all the people Google paid for? That doesn't sound like an arrangement Google would be happy with. (Which is to say, with more generality: people who get acquihired are basically temporarily invulnerable to office politics.)
  - ascar 8y ago
    The engineers involved were not part of YouTube at the time of acquisition. YouTube also wasn't really acquihire. The site had a huge user base Google wanted.
- ljm 8y ago
  I'd keep them on board but I'd get rid of that backdoor and encourage them to adapt to the new situation, for a number of reasons: - 'OldTubers' vs. the new Googlers is a clear us v. them thing. Bad for culture, especially when you get privileges on top. - Their plan was actually successful so there must have been a thing or two to learn on the product side, even if it's as simple as accepting engineering input and understanding the difficulty of maintaining stuff (as opposed to relying on the analytics). - There's some good thinking and ingenuity in there, despite the methodology. I'd want to keep hold of that talent while dealing with burgeoning elitism. Up to them to quit if they don't like the changes. Fire them if their contribution begins to suffer.
  - jrochkind1 8y ago
    Yes, you're right, there are options available other than 'firing' and that's the right one. This is why I'm not a manager. :)
  - user5994461 8y ago
    It's not a us v. them thing since they were not OldTuber and the article says that many other people were granted the access in spite of not being OldTuber.
  - bluedino 8y ago
    They’d quit and you’d kill morale. Something Yahoo would do.
- pjc50 8y ago
  This may be a management culture thing, but I would regard that happening as a massive red flag and immediately start looking to quit. Formal warning, perhaps, if it actually contravenes a written policy, but in this case is unlikely to have been one. There was no actual financial or reputation loss to the company.
  - HeWhoLurksLate 8y ago
    But mah autonomy!!! THB, meh.
- Cyberspy 8y ago
  It doesn't seem though, from the story, that the 'OldTubers' group was exposed. It seems like the 'why' was more important than the 'how'
darawk 8y ago
This is exactly the sort of riskless sentiment that causes something like IE6 to persist forever. > I mean, who are we to say that this was doing it right? It turned out to be beneficial but there are thousands of ways that this could explode in your face if you tried it yourself. How would this explode in your face, exactly? What was the risk here?
- saagarjha 8y ago
  From what it looks like, this is quite literally the ability to get code into the main codebase with no oversight. Even without malicious intentions, it seems very easy to do something awful by accident.
  - derefr 8y ago
    The main codebase... of a video sharing site. With no SLAs, and (at the time) no partner video-hosting agreements. The most awful thing that could happen to 2006-era YouTube: they could stop delivering ad impressions for an hour or two. Oh wait, no; 2006-era YouTube didn't even have ads yet.
    - jrochkind1 8y ago
      I suppose more awful thing could be an accidental XSS or other vulnerability.
      - darawk 8y ago
        Which would then compromise what? People's youtube accounts?
        0xDEFC0DE 8y ago
        IE6 had plenty of nasty vulns by the time this banner had gone up (06/14/2009): https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-124/version_id-8371/Microsoft-IE-6.0.html https://www.cvedetails.com/vulnerability-list/vendor_id-26/p... That said, the people with this access probably knew WTF they were doing.
soulofmischief 8y ago
They weren't working at a medical or financial company so your argument is pointless.
user17843 8y ago
This is not comparable imho. No medical or financial company has this vibrant engineering IT culture like the web startups 20 years ago had. Everything was new and exciting, and things moved foreward exactly due to the flexibility of all involved, the uncertainty, the flat hierarchies, and the fact that many rules either didn't exist, or only existed on paper. This is what happens everytime a new market emerges, where structures need some time to settle. Once they have settled down, procedures become standardized, but they also become so boring that all innovation is lost. What happend at Youtube 12 years ago is exactly what happens right now at some Cryptocurrency start ups. The start ups that are succesful are exactly those start ups where people like this Youtube engineer do not get fired. If YT had such an authoritarian attitude in 2009, they would never have become succesful. It's easy for the blog author to say "I have no idea why we weren't fired" but I bet back then it was all fun and games. (Getting fired isn't even that bad, what really harms people is when everyone around them starts to tell them things like "You could have ruined everything!") And something similar to the excitement and fluidity within the Youtube of 12 years ago happened 80 years ago in pharmaceutical companies, or 200 years ago within a Bank, when such structures were still freshly formed.
- user5994461 8y ago
  What makes you think it's different in financial organizations?
  - user17843 8y ago
    I just implied it is different because the industry was so young, it is solidified now, thus resembling other industries. (i.e. in the corporate world the hierarchies in big tech now resemble the hierarchies in big [insert any other industry])
    - antoineMoPa 8y ago
      In my experience, I think it is a question of developper count and company culture. Larger corporations have processes & checks that smaller businesses do not always have.
deleted 8y ago
[deleted]
jeromebaek 8y ago
This is correct, but there's a complication: YouTube today is a lot more than the YouYube of 2006. Today, people's livelihoods depend on YouTube. Naturally, I'd expect more responsible engineers.
megaremote 8y ago
If enough developers want to do something, you can't stop them. You can make it take more developers, that is the best you can do.
- profalseidol 8y ago
  Pretty sure there was enough developers whom hated JavaScript. What happened is that made more if it. A reality that we would still be supporting IE6 today because so many businesses still use it seems realistic to me. Maybe we would have developed a facade for it.. This brave actions of the OldTuber saved us a ton of effort. Hopefully somebody from Oracle sneak in Clojure in the JVM!
baud147258 8y ago
> Imagine working at a medical or financial company and having secretive 'old timer' permissions that basically backdoored the company's engineering processes Have you heard about Kerviel? A trader that cost his banks a few billions of euros? He was able to do this because he could bypass reviews by his boss and the internal compliance team. https://en.wikipedia.org/wiki/J%C3%A9r%C3%B4me_Kerviel https://en.wikipedia.org/wiki/J%C3%A9r%C3%B4me_Kerviel Edit: to be fair, it look like he took the blame for all the failings of the company
- makapuf 8y ago
  The whole question about Kerviel is if his management let him "bypass" regulatory safety nets or if he did it by himself.
ufmace 8y ago
This seems like a kind of silly objection. It's kind of like - I have some knives in my kitchen for cutting food, as does most of the world's population. I, or anyone else, could pick one up and go out and stab somebody. 99% of the world is capable of not doing that. Can't we presume that all of this setup happened because everyone involved knew perfectly well that it was just a moderately popular video hosting site? And that they would all have behaved differently if they knew that peoples' life savings and medical histories were at risk? Did it go out of style somehow to presume that people were mostly sane most of the time?

by ljm 8y ago

jrochkind1 8y ago

Yes. I love the story, and if I had been in charge I don't see how I could do anything but fire the whole lot of them. Although... the number of people involved in the "OldTubers" backdoor seems to have been pretty substantial, I don't know if they could really have fired all of them... But who is anyone to say if doing anything is "right"? We're all equally qualified to have a moral compass.

derefr 8y ago
I mean, Google just paid a ton of money to acquihire this team, and then the acquihired team is going to turn around and fire all the people Google paid for? That doesn't sound like an arrangement Google would be happy with. (Which is to say, with more generality: people who get acquihired are basically temporarily invulnerable to office politics.)
- ascar 8y ago
  The engineers involved were not part of YouTube at the time of acquisition. YouTube also wasn't really acquihire. The site had a huge user base Google wanted.
ljm 8y ago
I'd keep them on board but I'd get rid of that backdoor and encourage them to adapt to the new situation, for a number of reasons: - 'OldTubers' vs. the new Googlers is a clear us v. them thing. Bad for culture, especially when you get privileges on top. - Their plan was actually successful so there must have been a thing or two to learn on the product side, even if it's as simple as accepting engineering input and understanding the difficulty of maintaining stuff (as opposed to relying on the analytics). - There's some good thinking and ingenuity in there, despite the methodology. I'd want to keep hold of that talent while dealing with burgeoning elitism. Up to them to quit if they don't like the changes. Fire them if their contribution begins to suffer.
- jrochkind1 8y ago
  Yes, you're right, there are options available other than 'firing' and that's the right one. This is why I'm not a manager. :)
- user5994461 8y ago
  It's not a us v. them thing since they were not OldTuber and the article says that many other people were granted the access in spite of not being OldTuber.
- bluedino 8y ago
  They’d quit and you’d kill morale. Something Yahoo would do.
pjc50 8y ago
This may be a management culture thing, but I would regard that happening as a massive red flag and immediately start looking to quit. Formal warning, perhaps, if it actually contravenes a written policy, but in this case is unlikely to have been one. There was no actual financial or reputation loss to the company.
- HeWhoLurksLate 8y ago
  But mah autonomy!!! THB, meh.
Cyberspy 8y ago
It doesn't seem though, from the story, that the 'OldTubers' group was exposed. It seems like the 'why' was more important than the 'how'

darawk 8y ago

This is exactly the sort of riskless sentiment that causes something like IE6 to persist forever. > I mean, who are we to say that this was doing it right? It turned out to be beneficial but there are thousands of ways that this could explode in your face if you tried it yourself. How would this explode in your face, exactly? What was the risk here?

saagarjha 8y ago
From what it looks like, this is quite literally the ability to get code into the main codebase with no oversight. Even without malicious intentions, it seems very easy to do something awful by accident.
- derefr 8y ago
  The main codebase... of a video sharing site. With no SLAs, and (at the time) no partner video-hosting agreements. The most awful thing that could happen to 2006-era YouTube: they could stop delivering ad impressions for an hour or two. Oh wait, no; 2006-era YouTube didn't even have ads yet.
  - jrochkind1 8y ago
    I suppose more awful thing could be an accidental XSS or other vulnerability.
    - darawk 8y ago
      Which would then compromise what? People's youtube accounts?
      - 0xDEFC0DE 8y ago
        IE6 had plenty of nasty vulns by the time this banner had gone up (06/14/2009): https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-124/version_id-8371/Microsoft-IE-6.0.html https://www.cvedetails.com/vulnerability-list/vendor_id-26/p... That said, the people with this access probably knew WTF they were doing.

soulofmischief 8y ago

They weren't working at a medical or financial company so your argument is pointless.

user17843 8y ago

This is not comparable imho. No medical or financial company has this vibrant engineering IT culture like the web startups 20 years ago had. Everything was new and exciting, and things moved foreward exactly due to the flexibility of all involved, the uncertainty, the flat hierarchies, and the fact that many rules either didn't exist, or only existed on paper. This is what happens everytime a new market emerges, where structures need some time to settle. Once they have settled down, procedures become standardized, but they also become so boring that all innovation is lost. What happend at Youtube 12 years ago is exactly what happens right now at some Cryptocurrency start ups. The start ups that are succesful are exactly those start ups where people like this Youtube engineer do not get fired. If YT had such an authoritarian attitude in 2009, they would never have become succesful. It's easy for the blog author to say "I have no idea why we weren't fired" but I bet back then it was all fun and games. (Getting fired isn't even that bad, what really harms people is when everyone around them starts to tell them things like "You could have ruined everything!") And something similar to the excitement and fluidity within the Youtube of 12 years ago happened 80 years ago in pharmaceutical companies, or 200 years ago within a Bank, when such structures were still freshly formed.

user5994461 8y ago
What makes you think it's different in financial organizations?
- user17843 8y ago
  I just implied it is different because the industry was so young, it is solidified now, thus resembling other industries. (i.e. in the corporate world the hierarchies in big tech now resemble the hierarchies in big [insert any other industry])
  - antoineMoPa 8y ago
    In my experience, I think it is a question of developper count and company culture. Larger corporations have processes & checks that smaller businesses do not always have.

deleted 8y ago

[deleted]

jeromebaek 8y ago

This is correct, but there's a complication: YouTube today is a lot more than the YouYube of 2006. Today, people's livelihoods depend on YouTube. Naturally, I'd expect more responsible engineers.

megaremote 8y ago

If enough developers want to do something, you can't stop them. You can make it take more developers, that is the best you can do.

profalseidol 8y ago
Pretty sure there was enough developers whom hated JavaScript. What happened is that made more if it. A reality that we would still be supporting IE6 today because so many businesses still use it seems realistic to me. Maybe we would have developed a facade for it.. This brave actions of the OldTuber saved us a ton of effort. Hopefully somebody from Oracle sneak in Clojure in the JVM!

baud147258 8y ago

> Imagine working at a medical or financial company and having secretive 'old timer' permissions that basically backdoored the company's engineering processes Have you heard about Kerviel? A trader that cost his banks a few billions of euros? He was able to do this because he could bypass reviews by his boss and the internal compliance team. https://en.wikipedia.org/wiki/J%C3%A9r%C3%B4me_Kerviel https://en.wikipedia.org/wiki/J%C3%A9r%C3%B4me_Kerviel Edit: to be fair, it look like he took the blame for all the failings of the company

makapuf 8y ago
The whole question about Kerviel is if his management let him "bypass" regulatory safety nets or if he did it by himself.

ufmace 8y ago

This seems like a kind of silly objection. It's kind of like - I have some knives in my kitchen for cutting food, as does most of the world's population. I, or anyone else, could pick one up and go out and stab somebody. 99% of the world is capable of not doing that. Can't we presume that all of this setup happened because everyone involved knew perfectly well that it was just a moderately popular video hosting site? And that they would all have behaved differently if they knew that peoples' life savings and medical histories were at risk? Did it go out of style somehow to presume that people were mostly sane most of the time?