TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Youtube Live Epic Failure (Plaintext DB Password Exposed)

96 pointsby a904guyover 14 years ago
From: http://techcrunch.com/2010/09/12/youtube-live-streaming/<p>The widget embedded is rendering this on the page:<p>Traceback (most recent call last):<p><pre><code> File "/base/python_runtime/python_lib/versions/1/google/appengine/ext/webapp/__init__.py", line 511, in __call__ handler.get(*groups) File "/base/data/home/apps/yt-live/1.344714172147360500/event.py", line 69, in get evs = get_rows() File "/base/data/home/apps/yt-live/1.344714172147360500/event.py", line 9, in get_rows client = gdata.spreadsheet.text_db.DatabaseClient('kieran@bynd.com', 'projectmetal') File "/base/data/home/apps/yt-live/1.344714172147360500/gdata/spreadsheet/text_db.py", line 106, in __init__ self.SetCredentials(username, password) File "/base/data/home/apps/yt-live/1.344714172147360500/gdata/spreadsheet/text_db.py", line 127, in SetCredentials raise CaptchaRequired('Please visit https://www.google.com/accounts/'</code></pre> CaptchaRequired: Please visit https://www.google.com/accounts/DisplayUnlockCaptcha to unlock your account.

12 comments

davidwover 14 years ago
One guy's password getting out, in the grand scheme of things, is perhaps not an "epic failure". I mean, it's a screwup all right, but perhaps some perspective is in order...
评论 #1686156 未加载
评论 #1686159 未加载
viraptorover 14 years ago
Slightly off-topic, but I wonder what is their versioning strategy. 1.344714172147360500 is pretty bizarre. Does anyone know how / why it's used?
评论 #1686153 未加载
评论 #1686082 未加载
评论 #1686293 未加载
oscardelbenover 14 years ago
That's why you should never expose tracebacks in a production environment. But plain text? Really?
hellweaver666over 14 years ago
This reminds me of the time php.net went funny and started outputting all their PHP as text/html - they kept their DB credentials in a file included from their public_html directory and we were able to read the host details and username and password for their CMS.<p>Never ceases to amaze me that even big sites make little mistakes like that!
评论 #1686384 未加载
评论 #1709426 未加载
aw3c2over 14 years ago
That is one embarassingly trivial password
评论 #1686699 未加载
pilifover 14 years ago
Doesn't google docs support OAuth? That password should never have been in the code to begin with.
Thascover 14 years ago
... has anyone told Kieran?
评论 #1688865 未加载
Garbageover 14 years ago
Have you reported this?
评论 #1685755 未加载
simplegeekover 14 years ago
Just out of curiosity what Python web framework YouTube uses?
rifficover 14 years ago
I hope kieran changes that password if he uses it elsewhere.
a904guyover 14 years ago
The widget has since been removed.
a904guyover 14 years ago
Widget is back. (Working)