6 ms·

1) At the blocking moment I had only 2 videos (just screen records) on my channel which showed the same problem in 2 different Grammarly products 2) these video

1) At the blocking moment I had only 2 videos (just screen records) on my channel which showed the same problem in 2 different Grammarly products 2) these videos were an illustration for my report https://hackerone.com/reports/1282282 https://hackerone.com/reports/1282282, which Grammarly disclosed to the public and does not consider this a problem. 3) these videos were published after Grammarly representatives allowed me to release this information 4) in the description of the video there were links to the HackerOne case for the problem and to my blog https://evilksandr.medium.com/7bdb343c956b https://evilksandr.medium.com/7bdb343c956b with a detailed study of this problem 5) the video was posted for educational purposes only and without malicious intent I believe that my channel was blocked by mistake. Please, anyone who knows somebody from YT/G team, tag them in my tweet.

ballenf 5y ago
Why did you consider tricking the plagiarism detection engine a hack? Seems more like just one of probably several or even dozens of ways to trick the detection engine. While I applaud your work and clearly think the channel suspension is BS, I just don't know that I would have thought "HackerOne" when I discovered the issue.
- ipaddr 5y ago
  Trick the program into doing something other than intended is a hack. Whether someone cares enough to pay a bounty is something else
  - evilksandr 5y ago
    Grammarly didn't pay me even a penny for this issue I published in their Bug Bounty channel on the HackerOne.
- dylan604 5y ago
  History is filled with people having an idea, thinking it is not worth pursuing, then watching someone else actually do something with that idea instead, followed by the first person downplaying the idea altogether.
Ironlikebike 5y ago
My son (a curious juvenile) found his own YouTube account banned in a similar manner for disclosing a security issue in Google wifi products. There was no first or second warning (despite what the Terms of Service say). Google would not give him a justification for the banning other than "terms of service violation". The appeals fell on deaf ears. Now their automated system keeps banning every YouTube account he creates within days of creation. I worry that he'll never be able to appeal and a stupid 'mistaken reading of the ToS' on his part as a minor will affect his ability to ever host a YouTube channel or have a premium account subscription. Good luck getting a real human in Google to sympathize with your plight and restore your account. They see disclosure of security issues related to their products or their customers' products as ToS violations and appear to be unyielding and swift in silencing such content permanently.
- usbqk 5y ago
  I think they recently changed the tos to blacklist all videos regarding hacking and similar stuff
  - MereInterest 5y ago
    Looks like it's buried several layers deep, and very poorly worded. You need to go from the Terms of Service [0], to the Community Guidelines [1], to the subsection on "Harmful or dangerous content" [2]. Once there, the wording of the guideline is as follows. > Hacking: Demonstrating how to use computers or information technology with the intent to steal credentials, compromise personal data or cause serious harm to others such as (but not limited to) hacking into social media accounts. The placement of "with the intent to" is really weird to me. I could see it applying either to the demonstration being performed with intent, or the demonstrated usage having intent. The latter doesn't really make sense, because any basic computer usage could also be done with the intent to perform malicious actions. (e.g. "How to back-up your stored passwords", used maliciously to back-up somebody else's stored passwords.) The former would make sense, but not be applicable in this case. It would apply to cases where the video itself was an attempt to steal credentials, such as guiding people to a known compromised browser extension. In order for this to apply, the "with the intent to" clause would need to be missing entirely. In that case, a demonstration alone would be enough to fall under that clause. So either Google poorly wrote their guidelines, or are poorly applying it. But that's just from the strict letter of the ToS, which is as meaningless as a fart in a breeze when Google can unilaterally amend them. The real story is that Google is removing content in order to protect itself and others from embarrassment, and their actions to discredit and downplay responsible disclosure are what matter here, not their supposed justification of those actions. [0] https://www.youtube.com/static?template=terms https://www.youtube.com/static?template=terms [1] https://www.youtube.com/howyoutubeworks/policies/community-guidelines/ https://www.youtube.com/howyoutubeworks/policies/community-g... [2] https://support.google.com/youtube/answer/2801964 https://support.google.com/youtube/answer/2801964

ballenf 5y ago

Why did you consider tricking the plagiarism detection engine a hack? Seems more like just one of probably several or even dozens of ways to trick the detection engine. While I applaud your work and clearly think the channel suspension is BS, I just don't know that I would have thought "HackerOne" when I discovered the issue.

ipaddr 5y ago
Trick the program into doing something other than intended is a hack. Whether someone cares enough to pay a bounty is something else
- evilksandr 5y ago
  Grammarly didn't pay me even a penny for this issue I published in their Bug Bounty channel on the HackerOne.
dylan604 5y ago
History is filled with people having an idea, thinking it is not worth pursuing, then watching someone else actually do something with that idea instead, followed by the first person downplaying the idea altogether.

Ironlikebike 5y ago

My son (a curious juvenile) found his own YouTube account banned in a similar manner for disclosing a security issue in Google wifi products. There was no first or second warning (despite what the Terms of Service say). Google would not give him a justification for the banning other than "terms of service violation". The appeals fell on deaf ears. Now their automated system keeps banning every YouTube account he creates within days of creation. I worry that he'll never be able to appeal and a stupid 'mistaken reading of the ToS' on his part as a minor will affect his ability to ever host a YouTube channel or have a premium account subscription. Good luck getting a real human in Google to sympathize with your plight and restore your account. They see disclosure of security issues related to their products or their customers' products as ToS violations and appear to be unyielding and swift in silencing such content permanently.

usbqk 5y ago
I think they recently changed the tos to blacklist all videos regarding hacking and similar stuff
- MereInterest 5y ago
  Looks like it's buried several layers deep, and very poorly worded. You need to go from the Terms of Service [0], to the Community Guidelines [1], to the subsection on "Harmful or dangerous content" [2]. Once there, the wording of the guideline is as follows. > Hacking: Demonstrating how to use computers or information technology with the intent to steal credentials, compromise personal data or cause serious harm to others such as (but not limited to) hacking into social media accounts. The placement of "with the intent to" is really weird to me. I could see it applying either to the demonstration being performed with intent, or the demonstrated usage having intent. The latter doesn't really make sense, because any basic computer usage could also be done with the intent to perform malicious actions. (e.g. "How to back-up your stored passwords", used maliciously to back-up somebody else's stored passwords.) The former would make sense, but not be applicable in this case. It would apply to cases where the video itself was an attempt to steal credentials, such as guiding people to a known compromised browser extension. In order for this to apply, the "with the intent to" clause would need to be missing entirely. In that case, a demonstration alone would be enough to fall under that clause. So either Google poorly wrote their guidelines, or are poorly applying it. But that's just from the strict letter of the ToS, which is as meaningless as a fart in a breeze when Google can unilaterally amend them. The real story is that Google is removing content in order to protect itself and others from embarrassment, and their actions to discredit and downplay responsible disclosure are what matter here, not their supposed justification of those actions. [0] https://www.youtube.com/static?template=terms https://www.youtube.com/static?template=terms [1] https://www.youtube.com/howyoutubeworks/policies/community-guidelines/ https://www.youtube.com/howyoutubeworks/policies/community-g... [2] https://support.google.com/youtube/answer/2801964 https://support.google.com/youtube/answer/2801964