6 ms·

This is exactly the sort of riskless sentiment that causes something like IE6 to persist forever. > I mean, who are we to say that this was doing it right? It

by darawk 8y ago

This is exactly the sort of riskless sentiment that causes something like IE6 to persist forever. > I mean, who are we to say that this was doing it right? It turned out to be beneficial but there are thousands of ways that this could explode in your face if you tried it yourself. How would this explode in your face, exactly? What was the risk here?

saagarjha 8y ago
From what it looks like, this is quite literally the ability to get code into the main codebase with no oversight. Even without malicious intentions, it seems very easy to do something awful by accident.
- derefr 8y ago
  The main codebase... of a video sharing site. With no SLAs, and (at the time) no partner video-hosting agreements. The most awful thing that could happen to 2006-era YouTube: they could stop delivering ad impressions for an hour or two. Oh wait, no; 2006-era YouTube didn't even have ads yet.
  - jrochkind1 8y ago
    I suppose more awful thing could be an accidental XSS or other vulnerability.
    - darawk 8y ago
      Which would then compromise what? People's youtube accounts?
      - 0xDEFC0DE 8y ago
        IE6 had plenty of nasty vulns by the time this banner had gone up (06/14/2009): https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-124/version_id-8371/Microsoft-IE-6.0.html https://www.cvedetails.com/vulnerability-list/vendor_id-26/p... That said, the people with this access probably knew WTF they were doing.
        darawk 8y ago
        Exactly. They were getting rid of IE6
    - chris_wot 8y ago
      As opposed to the denial of service style bugs like an empty src element in an img tag?
      - ljm 8y ago
        They're perfectly capable of introducing other DOS bugs that don't depend on bad markup.
        dgoldstein0 8y ago
        This is a poor argument - just because we can shoot our own feet, doesn't mean we should not try to prevent it from happening by accident. And it sounds like it wasn't just DOS - also just plain "it doesn't work in ie6" seems the most likely outcome; crashes and DOS that the article describes just sounds like the most egregious cases.
- user17843 8y ago
  of course there was oversight. Those with experience had privileged access. Basically meritocracy. Today innovation and movement is stiffled by large corprate and legal structures where engineers only recieve commands.
- deleted 8y ago
  [deleted]
- Cyberspy 8y ago
  This is why I like to work at small businesses, where I'm either the only developer or one of just a few. Even with annual turnovers, through the website, of approaching $10million/year (in my current and last role) there is very little oversight of what I do - there's literally no-one to challenge me on a technical level. That doesn't mean I abuse my position, but it does give me a lot of technical freedom in how I create the functionality the business asks for.
  - profalseidol 8y ago
    Reminds me of Marx's Alienation of the worker from their product.
- Aeolun 8y ago
  This must not be such a strange ability? Even at ‘big enterprise corp’ we have the ability (though not necessarily approval) to push directly to master, and I doubt there’s more restrictions in smaller companies.
- dwheeler 7y ago
  It's not like there was no oversight. As noted in the article, their boss was in on it, and "the rest of us leveraged our OldTuber status to approve the code review." so there was review. They short-circuited a number of the usual steps, but it's not like there was a single person who made all the decisions.
ljm 8y ago
Take it away from the specific case of IE6, and consider the situation where you have a product team that says one thing and a team of engineers insist on their solution. They got lucky, IE6 in that sense was ready to die, and they basically declared mutiny with good cause. Can you imagine any other scenario where insisting your idea is correct above every alternative, to the extent you can bypass the organisation and enforce your idea, could be utterly catastrophic? These developers in particular set up a system to subvert their own company. They even said it themselves: Legal shit their pants because they tried it and saw Chrome as the first suggestion. They were lucky that the media didn't capitalise on that if they got the same ordering. This story with Youtube and IE6 is romantic. It's not realistic or aspirational. Besides which, we would not hear of it if the attempt failed.
- darawk 8y ago
  > They got lucky, IE6 in that sense was ready to die, and they basically declared mutiny with good cause. Ok, and if IE6 had not been ready to die, what kind of catastrophe would have ensued? > Can you imagine any other scenario where insisting your idea is correct above every alternative, to the extent you can bypass the organisation and enforce your idea, could be utterly catastrophic? These developers in particular set up a system to subvert their own company. I can imagine catastrophes. But they're mostly the sorts of catastrophes that are bad for an organization, but great for a civilization. > This story with Youtube and IE6 is romantic. It's not realistic or aspirational. Besides which, we would not hear of it if the attempt failed. Something we don't hear about if it fails, but produces a great social benefit if it succeeds seems like exactly the sort of thing we should be doing.
  - not2b 8y ago
    No catastrophe would have ensued. They didn't remove support for IE6. They put up a banner telling IE6 users that support would be removed some time in the future. Only taking the second step (actually removing support) would have any consequences. If a large, powerful contingent demanded that IE6 support be kept indefinitely and persuaded management of this, the banner would have been removed.
gcbw2 8y ago
> How would this explode in your face, exactly? What was the risk here? for one thing that actually happened because they did (and got away) with this: youtube engineers feel like they can leverage their site to dictate what they want in the browser space, by deliberately making it 5x slower on firefox and edge[0]. As a rule of thumb, if something looks fishy and shady, but just because it doesn't directly explodes in your face, treat it as a "but I don't have anything to hide" situation, and be against it. Because eventually, it will be your face. [0] http://fortune.com/2018/07/25/youtube-slow-mozilla-firefox-chrome/ http://fortune.com/2018/07/25/youtube-slow-mozilla-firefox-c...
- darawk 8y ago
  > for one thing that actually happened because they did (and got away) with this: youtube engineers feel like they can leverage their site to dictate what they want in the browser space, by deliberately making it 5x slower on firefox and edge[0]. There's no evidence that that was deliberate. These two things are also pretty completely unrelated.
  - fjsolwmv 8y ago
    They deliberately chose to run pre-release performance testing on chrome but not other browsers.
munk-a 8y ago
> How would this explode in your face, exactly? What was the risk here? The risk could be that a competitor could step into the market and use "legacy support" as a positive of their platform. Youtube is weird - especially at that time - since it didn't really have any movers and shakers in terms of either consumers or producers, but if they were selling software that corporations legitimately use (for instance - vimeo offers good streaming video embeds that do "things" to try and restrict the video to a limited audience) then a company using this service to host their streaming videos may be motivated to shift off of that service to a competitor that won't artificially limit the users that can actually use this third party plugin. Again, it's a bit hard to say here with YouTube in particular, because it isn't a place where work happened at that point[1] so none of the consumers wielded significant power - honestly YouTube may have been fine just say "Welp, 18% of our user base is forcing us into supporting janky old browsers - guess we're losing 18% of our user base and saving a bunch on code maintenance." [1] Now there are streamers that may legitimately threaten the company if they threaten to jump ship, it's economically weird but beside the point... just, back then there was nothing.
- darawk 8y ago
  I agree that in a hypothetical scenario that this wasn't, it could have been a catastrophe. But in the one that actually existed, it couldn't have been.
  - munk-a 8y ago
    I disagree, since in this actual situation their actions caused google drive to jump on the bandwagon and they run an actual business with competitors that would be happy to guarantee long term support. All that said... I had to work with ie6, it is terrible, and these people are heroes.
- vijaybritto 8y ago
  Do you seriously think people would scrap off their contracts for legacy browser support? This is not like all or nothing. If they think its unfair then the org is gonna complain to the vendor about this. I don't know if any org can decide to switch over to a different vendor without trying to resolve first.

by darawk 8y ago

saagarjha 8y ago

From what it looks like, this is quite literally the ability to get code into the main codebase with no oversight. Even without malicious intentions, it seems very easy to do something awful by accident.

derefr 8y ago
The main codebase... of a video sharing site. With no SLAs, and (at the time) no partner video-hosting agreements. The most awful thing that could happen to 2006-era YouTube: they could stop delivering ad impressions for an hour or two. Oh wait, no; 2006-era YouTube didn't even have ads yet.
- jrochkind1 8y ago
  I suppose more awful thing could be an accidental XSS or other vulnerability.
  - darawk 8y ago
    Which would then compromise what? People's youtube accounts?
    - 0xDEFC0DE 8y ago
      IE6 had plenty of nasty vulns by the time this banner had gone up (06/14/2009): https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-124/version_id-8371/Microsoft-IE-6.0.html https://www.cvedetails.com/vulnerability-list/vendor_id-26/p... That said, the people with this access probably knew WTF they were doing.
      - darawk 8y ago
        Exactly. They were getting rid of IE6
  - chris_wot 8y ago
    As opposed to the denial of service style bugs like an empty src element in an img tag?
    - ljm 8y ago
      They're perfectly capable of introducing other DOS bugs that don't depend on bad markup.
      - dgoldstein0 8y ago
        This is a poor argument - just because we can shoot our own feet, doesn't mean we should not try to prevent it from happening by accident. And it sounds like it wasn't just DOS - also just plain "it doesn't work in ie6" seems the most likely outcome; crashes and DOS that the article describes just sounds like the most egregious cases.
user17843 8y ago
of course there was oversight. Those with experience had privileged access. Basically meritocracy. Today innovation and movement is stiffled by large corprate and legal structures where engineers only recieve commands.
deleted 8y ago
[deleted]
Cyberspy 8y ago
This is why I like to work at small businesses, where I'm either the only developer or one of just a few. Even with annual turnovers, through the website, of approaching $10million/year (in my current and last role) there is very little oversight of what I do - there's literally no-one to challenge me on a technical level. That doesn't mean I abuse my position, but it does give me a lot of technical freedom in how I create the functionality the business asks for.
- profalseidol 8y ago
  Reminds me of Marx's Alienation of the worker from their product.
Aeolun 8y ago
This must not be such a strange ability? Even at ‘big enterprise corp’ we have the ability (though not necessarily approval) to push directly to master, and I doubt there’s more restrictions in smaller companies.
dwheeler 7y ago
It's not like there was no oversight. As noted in the article, their boss was in on it, and "the rest of us leveraged our OldTuber status to approve the code review." so there was review. They short-circuited a number of the usual steps, but it's not like there was a single person who made all the decisions.

ljm 8y ago

Take it away from the specific case of IE6, and consider the situation where you have a product team that says one thing and a team of engineers insist on their solution. They got lucky, IE6 in that sense was ready to die, and they basically declared mutiny with good cause. Can you imagine any other scenario where insisting your idea is correct above every alternative, to the extent you can bypass the organisation and enforce your idea, could be utterly catastrophic? These developers in particular set up a system to subvert their own company. They even said it themselves: Legal shit their pants because they tried it and saw Chrome as the first suggestion. They were lucky that the media didn't capitalise on that if they got the same ordering. This story with Youtube and IE6 is romantic. It's not realistic or aspirational. Besides which, we would not hear of it if the attempt failed.

darawk 8y ago
> They got lucky, IE6 in that sense was ready to die, and they basically declared mutiny with good cause. Ok, and if IE6 had not been ready to die, what kind of catastrophe would have ensued? > Can you imagine any other scenario where insisting your idea is correct above every alternative, to the extent you can bypass the organisation and enforce your idea, could be utterly catastrophic? These developers in particular set up a system to subvert their own company. I can imagine catastrophes. But they're mostly the sorts of catastrophes that are bad for an organization, but great for a civilization. > This story with Youtube and IE6 is romantic. It's not realistic or aspirational. Besides which, we would not hear of it if the attempt failed. Something we don't hear about if it fails, but produces a great social benefit if it succeeds seems like exactly the sort of thing we should be doing.
- not2b 8y ago
  No catastrophe would have ensued. They didn't remove support for IE6. They put up a banner telling IE6 users that support would be removed some time in the future. Only taking the second step (actually removing support) would have any consequences. If a large, powerful contingent demanded that IE6 support be kept indefinitely and persuaded management of this, the banner would have been removed.

gcbw2 8y ago

> How would this explode in your face, exactly? What was the risk here? for one thing that actually happened because they did (and got away) with this: youtube engineers feel like they can leverage their site to dictate what they want in the browser space, by deliberately making it 5x slower on firefox and edge[0]. As a rule of thumb, if something looks fishy and shady, but just because it doesn't directly explodes in your face, treat it as a "but I don't have anything to hide" situation, and be against it. Because eventually, it will be your face. [0] http://fortune.com/2018/07/25/youtube-slow-mozilla-firefox-chrome/ http://fortune.com/2018/07/25/youtube-slow-mozilla-firefox-c...

darawk 8y ago
> for one thing that actually happened because they did (and got away) with this: youtube engineers feel like they can leverage their site to dictate what they want in the browser space, by deliberately making it 5x slower on firefox and edge[0]. There's no evidence that that was deliberate. These two things are also pretty completely unrelated.
- fjsolwmv 8y ago
  They deliberately chose to run pre-release performance testing on chrome but not other browsers.

munk-a 8y ago

> How would this explode in your face, exactly? What was the risk here? The risk could be that a competitor could step into the market and use "legacy support" as a positive of their platform. Youtube is weird - especially at that time - since it didn't really have any movers and shakers in terms of either consumers or producers, but if they were selling software that corporations legitimately use (for instance - vimeo offers good streaming video embeds that do "things" to try and restrict the video to a limited audience) then a company using this service to host their streaming videos may be motivated to shift off of that service to a competitor that won't artificially limit the users that can actually use this third party plugin. Again, it's a bit hard to say here with YouTube in particular, because it isn't a place where work happened at that point[1] so none of the consumers wielded significant power - honestly YouTube may have been fine just say "Welp, 18% of our user base is forcing us into supporting janky old browsers - guess we're losing 18% of our user base and saving a bunch on code maintenance." [1] Now there are streamers that may legitimately threaten the company if they threaten to jump ship, it's economically weird but beside the point... just, back then there was nothing.

darawk 8y ago
I agree that in a hypothetical scenario that this wasn't, it could have been a catastrophe. But in the one that actually existed, it couldn't have been.
- munk-a 8y ago
  I disagree, since in this actual situation their actions caused google drive to jump on the bandwagon and they run an actual business with competitors that would be happy to guarantee long term support. All that said... I had to work with ie6, it is terrible, and these people are heroes.
vijaybritto 8y ago
Do you seriously think people would scrap off their contracts for legacy browser support? This is not like all or nothing. If they think its unfair then the org is gonna complain to the vendor about this. I don't know if any org can decide to switch over to a different vendor without trying to resolve first.