Anyone else noticed the XSS attack on youtube?

[BenAshton24]

Probably best to avoid videos today... I noticed a few redirects among all the spam and marquees :P

[Sslaxx]

Assclowns. What's new?

[CharlesA]

It's youtube.. Lol.

[dragos240]

Isn't happening here. links?

[dragos240]

Nevermind I got a goatse redirect:-&

[LarsKongo]

Read that it's some sort of html injection in the comments that anons are having fun with. A rather simple security hole that Google should've tested long ago.

[Phrea]

Confirmed, anon is indeed having fun.

[Phrea]

<script>IF_HTML_FUNCTION?<h1><marquee><font color="red"><b>Text here.<script>

That's one of them.

[BenAshton24]

I want to know what's going to happen on 07/12/2010 (Scrnsht 2)

Also how did google let this happen when it's such an easy vulnerability to secure...

[FuturePilot]

/me hugs NoScript

[Helkaluin]

/me hugs NoScript
Seeing that the 'exploit' actually injects Javascript that will be fed from the youtube.com domain itself, I don't see that NoScript will protect your from them at all unless you block scripts from youtube.com... which actually will result in no videos.

Oh well. Google fixed it now anyway.

[LarsKongo]

Seeing that the 'exploit' actually injects Javascript that will be fed from the youtube.com domain itself, I don't see that NoScript will protect your from them at all unless you block scripts from youtube.com... which actually will result in no videos.
It does help a little. Any 3rd party sites you may be redirected to won't be able to run any malicious scripts.

[mr-woof]

i love no script

[undecim]

Well, with noscript, you need to have youtube blocked, but you can still click on the flash video to allow just that video.

[urukrama]

I don't have the problem in Elinks. :)