1) At the blocking moment I had only 2 videos (just screen records) on my channel which showed the same problem in 2 different Grammarly products 2) these videos were an illustration for my report https://hackerone.com/reports/1282282, which Grammarly disclosed to the public and does not consider this a problem. 3) these videos were published after Grammarly representatives allowed me to release this information 4) in the description of the video there were links to the HackerOne case for the problem and to my blog https://evilksandr.medium.com/7bdb343c956b with a detailed study of this problem 5) the video was posted for educational purposes only and without malicious intent I believe that my channel was blocked by mistake. Please, anyone who knows somebody from YT/G team, tag them in my tweet.
My son (a curious juvenile) found his own YouTube account banned in a similar manner for disclosing a security issue in Google wifi products. There was no first or second warning (despite what the Terms of Service say). Google would not give him a justification for the banning other than "terms of service violation". The appeals fell on deaf ears. Now their automated system keeps banning every YouTube account he creates within days of creation.
I worry that he'll never be able to appeal and a stupid 'mistaken reading of the ToS' on his part as a minor will affect his ability to ever host a YouTube channel or have a premium account subscription.
Good luck getting a real human in Google to sympathize with your plight and restore your account. They see disclosure of security issues related to their products or their customers' products as ToS violations and appear to be unyielding and swift in silencing such content permanently.
Wow. I think my big take-away is to never post disclosures about a company, on that company's platform.
No, I'm not being sarcastic either. I am sure some Company-Man type was the one who stumbled across it and implemented the ban.
Of course, the other lesson is one I have learned just reading tech news for years and years: Cover your bases and plan for retaliation. Even if the company in question doesn't have a history of that.
I think they recently changed the tos to blacklist all videos regarding hacking and similar stuff
We did quite extensive digging into the ToS and there was nothing explicitly forbidden about what he had done and they refused to point to any rule he had violated in particular. If they've updated it, it must have been in the last 4-5 months.
Looks like it's buried several layers deep, and very poorly worded. You need to go from the Terms of Service [0], to the Community Guidelines [1], to the subsection on "Harmful or dangerous content" [2]. Once there, the wording of the guideline is as follows.
> Hacking: Demonstrating how to use computers or information technology with the intent to steal credentials, compromise personal data or cause serious harm to others such as (but not limited to) hacking into social media accounts.
The placement of "with the intent to" is really weird to me. I could see it applying either to the demonstration being performed with intent, or the demonstrated usage having intent. The latter doesn't really make sense, because any basic computer usage could also be done with the intent to perform malicious actions. (e.g. "How to back-up your stored passwords", used maliciously to back-up somebody else's stored passwords.) The former would make sense, but not be applicable in this case. It would apply to cases where the video itself was an attempt to steal credentials, such as guiding people to a known compromised browser extension.
In order for this to apply, the "with the intent to" clause would need to be missing entirely. In that case, a demonstration alone would be enough to fall under that clause. So either Google poorly wrote their guidelines, or are poorly applying it.
But that's just from the strict letter of the ToS, which is as meaningless as a fart in a breeze when Google can unilaterally amend them. The real story is that Google is removing content in order to protect itself and others from embarrassment, and their actions to discredit and downplay responsible disclosure are what matter here, not their supposed justification of those actions.
[0] https://www.youtube.com/static?template=terms
[1] https://www.youtube.com/howyoutubeworks/policies/community-g...
> worry that he'll never be able to appeal and a stupid 'mistaken reading of the ToS' on his part as a minor will affect his ability to ever host a YouTube channel or have a premium account subscription.
How can a minor (who cannot sign a contract) be punished (legally) for not adhering to a ToS?
Well, the 'punishment' is not letting him use the service, which he wasn't supposed to be able to do anyway as a minor. It isn't like he is going to jail or being forced to pay a fine.
You seem to be arguing that you can't ever prevent minors from using your service, since you can only exclude them via your TOS and you can't enforce a TOS against minors.
This seems very similar to the arguments that "freeman of the land" use to argue that they can do whatever they want since they don't agree to be bound by laws.
The agreement can be voided.
Congratulations on figuring out how to keep your son’s data out of the hands of Google at such a young age. What a blessing that will be!
Many of the folks here have tried Degoogling with less success.
You can still track users without accounts. It's called finger printing. It's still probably associated with the main Google account too. There's tons of articles on Facebook and "dark" accounts.
These bans affect the YouTube Brand account / Channel only, Google accounts haven't been affected by regular YT ToS violations for a while.
Why did you consider tricking the plagiarism detection engine a hack? Seems more like just one of probably several or even dozens of ways to trick the detection engine.
While I applaud your work and clearly think the channel suspension is BS, I just don't know that I would have thought "HackerOne" when I discovered the issue.
History is filled with people having an idea, thinking it is not worth pursuing, then watching someone else actually do something with that idea instead, followed by the first person downplaying the idea altogether.
Trick the program into doing something other than intended is a hack.
Whether someone cares enough to pay a bounty is something else
Grammarly didn't pay me even a penny for this issue I published in their Bug Bounty channel on the HackerOne.
After Grammarly spent millions of dollars on Google ads, I expect them not to accept valid criticism on Google platforms.
But it's unfair to block a guy that talked about a real flaw in Grammarly's plagiarism checker, at least pretend that you allow free speech and take down that video for a random reason specified in your ToS.
I think you've incorrectly invoked "free speech" here, IMO this isn't a free speech issue. It may be a TOS issue and it does sound like Google are being a bit unreasonable but "free speech" isn't really something Google ever promised to permit on their platforms
Free speech isn’t just something that can be encoded into law, it’s an ideology. A great ideology, imo.
That said, with COVID-19 it really became apparent that these platforms have basically become a new public square, putting everyone in an awkward position. You can basically be ousted from the internet by just a couple entities like Facebook or Twitter and have your entire online presence torpedoed. IRL I can just go to a different bar, gym, whatever. On the internet, everything consolidates rapidly. It’s hard to argue that companies should be forced to allow things they don’t want on their platforms, but it’s clear that something has to be done here if platforms are going to consolidate this badly.
My point is not that "free speech" as a concept is bad (though I do mention in another comment here that it does raise thorny issues). My point is that tying this complaint and "free speech" together is pointless because it directs attention at the wrong thing.
It's the difference between saying "$person got kicked off Google in a violation of their free speech" and "$person got kicked off Google for a totally specious reason that doesn't even violate Google's TOS".
The first one gets immediately shut down because they didn't violate anyone's free speech. If you try to make that argument it's a total non-starter. We can have a big fun discussion about free speech online some time - and that does happen here on HN - but that's not the issue here.
The second one gets at the actual issue - Google have just booted someone even though they didn't apparently violate their TOS. They just arbitrarily did so to appease a paying client.
I hope this is clear.
It is refreshing to see someone who diagnoses the issue here correctly.
The root problem people are complaining about is the moderation policies, and the truth is that services like Facebook et al are simply too large to be effectively moderated. Appealing to (US ideas of) free speech would propose that the solution to bad moderation is no moderation whatsoever (speech restrictions must be content-neutral, and moderation by definition is not content-neutral)--and I think most people would rapidly find that no moderation is worse than bad moderation.
The most effective solution is to do what ought to have been done a decade ago and prevent further social media consolidation and consider breaking up the current oligopoly of social media.
Far to often nowadays I'll hear people defend communications-companies based on the idea that they can censor whatever they want because they're private entities. Mostly though, that idea is only true for them when they feel that their ideological opponents are being censored. Framing companies like google as new public squares is spot on.
And as you say, free speech is an ideology, and in my opinion this should be repeated. It is a culture and a mindset, not just laws, laws being downstreams from culture anyway. If you do not wish for it to apply in all those areas, in my opinion, you do not defend it at all.
It’s hard to argue that companies should be forced to allow things they don’t want on their platforms
Yes, because the concept of free speech has never implied that you're entitled to have other entities hear or repeat your speech nor is there any principle that compels someone else to listen to or repeat what you're saying. If you want that to be the case, that's certainly your prerogative, but that's a different concept from any mainstream definition of free speech I've come across.
Why is that not a free speech issue? It is not a legal issue of course, but removal of critical opinions very much qualifies to be a violation of the principle.
Because it's basically never been a thing there. Facebook, Twitter, Google - all of these platforms can and do remove things from their platforms for whatever reason they feel like. There's nothing we can do about it, there is no free speech there and acting indignant like they're eroding some right that you previously had is just pointless.
It'd be like complaining that you can't get sushi at McDonalds anymore. You couldn't ever do that, McDonalds haven't indicated that they would offer this and we all know it's not going to happen.
The (US) constitutional protections on speech constrain the actions of US governments; those constraints don't extend to private companies and individuals.
And "principles" are things you can adopt and agree with as you see fit. They are not law. Not everyone takes an absolutist position that "free speech" is a principle we should all be defending to the last ditch.
Unregulated monopolies do not have to uphold constitutional rights.
The phone company used to be regulated so even if you were a hated Republican they still had to provide phone service to you if you lived in their service area. Those days are over and monopolies in practice will never be redefined again as "legal monopolies".
It is definitely a free speech issue but not in the legal and constitutional sense that you're thinking of.
Regardless of the situation you're in, you have the ability to say, "I should have the right to free speech in this situation." Whether this belief will be validated in the reality of the situation is an entirely different matter.
On the contrary, that is exactly the sense I was thinking of. My point was that considering this in terms of an erosion of your free speech doesn't make sense because there's no expectation of free speech in places like Twitter, YouTube, Facebook, etc. There is an expectation that as long as you adhere to TOS you'll be allowed to continue to use a platform, however.
I just thought it was a mistake in this case to get into a broader debate about free speech online, what should be allowed, how it needs to account for various countries' conflicting laws, etc. Because that's a huge issue, it's probably not what was intended by the original commenter and we have a much more narrow and clearly defined issue we can focus on (being kicked off despite adhering to TOS).
> I should have the right to free speech
That's a legitimate opinion.
I am of the view that rights are things that are granted by some authority, not something you acquire by simply existing. I envy the USA their constitutional protections on speech. But unless Google has made a grant of free speech rights on their platform, no such rights exist.
Well "free speech" is a concept, context can be "${country_constitution_str}" or as in "humanitarian values"
First, Grammarly has nothing to do with this suspension or any problem with the videos in question.
Second, this is not a flaw or a hack but an unsuccessful attempt to use Grammarly for an UNINTENDED purpose. Grammarly is not meant for anti-plagiarism enforcement. Grammarly aims to help users avoid accidental or unintentional plagiarism by highlighting parts that may need to be cited. So it does not attempt to deal with any plagiarisms enforcement countermeasures - if someone is deliberately masking plagiarism, it's definitely not unintentional or accidental. It's trivial to overcome these particular counter-measures but that's just not what Grammarly is for.
Grammarly has a separate plagiarism checker https://www.grammarly.com/plagiarism-checker which was in my report
Oleksandre, you got an official response that this is by design. I explained why. This is a landing page, not a separate product, and the description of the plagiarism feature clearly states it's not for policing:
"...Our free plagiarism check will tell you whether or not your text contains duplicate content. Our Premium plagiarism check highlights passages that require citations and gives you the resources you need to properly credit your sources."
Thanks for your support!
For those wanting a more honest alternative to Grammarly, LanguageTool[1] is open source and quite good.
That said, I am not a power user and my English is just passable, so your mileage may vary.
I've been using LanguageTool over Grammarly for the past few years, and love it. Granted, I just use it occasionally, and it's possible that Grammarly is a tad better - but it's more than enough for my needs.
It's not as good as grammarly, but it will definitely help and isn't that hard to run. My tricks to run it on a cheap digital ocean server
0. Use the docker version
1. use maxsize memory flag to keep the memory under control
2. set up a cron job to kill/restart it in the middle of the night, every night.
3. use a reverse proxy to hide the address at least a little bit
Thanks for the pointer! I've been looking for a Grammarly alternative for ages now.
Their product is both ridiculously overpriced for what you get ($30/month, last I looked, for a spelling/grammar checker along the lines of what MS Word provides), a massive privacy/security violation (you have to send everything you type for the service to do its job; no corporate IT with a pulse would be okay with this), and worst of all, it's buggy as hell. Last time I tried it, it refused to work on HN even though this is a bog standard text field, and I spent a ton of time trying to get it to stop correcting things that didn't need corrected.
Thank you! If this tool works as good as Grammarly, I will cancel Grammarly subscription.
A Grammarly team member but posting own thoughts to clarify some things.
First, Grammarly has nothing to do with this suspension and does not have any problem with the videos in question, just as mentioned in the official HackerOne response.
Second, this is not a hack or even a flaw. It is an attempt to use Grammarly for a NON-INTENDED purpose, that predictably did not work. Grammarly is not meant for anti-plagiarism policy enforcement. Grammarly aims to help users avoid accidental or unintentional plagiarism by highlighting parts that may need to be cited. So it does not attempt to deal with any plagiarism enforcement countermeasures. If someone is deliberately masking plagiarism with these countermeasures, it's definitely NOT unintentional or accidental and a whole different issue altogether, so Grammarly does not get involved with this, by design. Bypassing the tool that is designed to HELP YOU avoid getting in trouble with accidental plagiarism is not a hack but more like "bypassing" your wifi by putting your own router in a microwave - defeating the purpose rather than defeating security. So Grammarly does not care about these videos (although I think presenting this as a hack or a flaw is a little unfair).
Finally, Youtube's automated (I'm guessing) blocking often does strange things. My account was once blocked for supposedly violating Sony's video game copyright. The video in question was me driving a car on a race track, in real life. It got unblocked within a week or two, though.
The product that he is talking about it specifically their plagiarism checker[1]
Their own documentation says the product is also for teachers to enforce rules.
This poster keeps making the same incorrect claims in multiple places in this thread, even after the original author clarifed it to him.
There is no separate product - it is a feature of the main product. Please point out where documentation says it's for enforcement because that will need to be corrected. It can help teachers educate students about plagiarism but it's not meant for enforcement. It's a student tool.
Here is the text from the linked landing page describing the plagiarism checker feature (emphasis mine):
Our free plagiarism check will tell you whether or not your text contains duplicate content. Our Premium plagiarism check highlights passages that require citations and gives you the resources you need to properly credit your sources.
This makes it quite clear that is an authoring tool, not policing tool. Plagiarism masking is not addressed by design. It's a trivial thing to code if there was a need but the company made a decision to stay out of plagiarism enforcement (at least for now).
From the page linked
> "Who Benefits from Grammarly’s Plagiarism Checker? Whether you’re a student writing an essay, a teacher grading papers, or a writer working on original content for the web, a plagiarism scan will not only save you time, but also help you avoid writing mistakes." ( emphasis mine)
Grammarly Sales has always sold it to academic institutions and teachers, it is must be news to them it is not meant for policing.
The four customers highlighted (Arizona State University, University of Phoenix, California State University, Ashford University ) on the page are all education institutions who most certainly use it for policing.
Also it is product and not feature because it is sold standalone and does not depend on license to their more well known grammar checking product to work.
Thanks for your detailed answer. Let me post my thoughts:
1. 3 years ago I conducted research on almost all online tools which check for plagiarism with free access or using a trial account. Tool, located with URL https://www.grammarly.com/plagiarism-checker was one of them because "Grammarly’s plagiarism checker can detect plagiarism from billions of web pages as well as from ProQuest’s academic databases."
2. I repeat research half a year ago and discovered, that at least 3 plagiarism checkers already have fixed the issue I described in my report, but not Grammarly.
3. I posted a case on HackerOne https://hackerone.com/reports/1282282 with the weakness type "Business Logic Errors", and did not mention "security" or "privacy".
4. Please, read again (and also look between the lines) everything that is described in the section "Impact" and my answer about the impact of the reported behavior.
5. You already have a software reviews company in your customers (I didn't know it while published my report). Imagine, that they will decide to automate plagiarism checking for all the reviews, and somebody starts to use the method I described. I will not continue this topic.
6. I posted a case to HackerOne with the intent to warn against this behavior.
7. After your team decided not to track this report as a security or major product issue, I asked permission to publish my report and got it.
8. My videos about it were on youtube for 4 months, but on Jan 5 youtube changed their ToS and on Jan 7 my channel was suspended.
So, I will try to appeal again to @TeamYouTube about my channel using your answer "Grammarly does not have any problem with the videos in question, just as mentioned in the official HackerOne response.", but think it will be a hard process.
Yes, please feel free to mention that to Youtube. If it helps, I can get the company (Grammarly) to officially confirm that the videos are not a problem if Youtube needs a confirmation.
But I am absolutely certain this is by design, and that's why there was no change. It's not a policing tool but an authoring tool. What you described in #5 is not an intended use of the product and is a violation of TOS.
For the whole picture, please show where in the Grammarly's ToS it is forbidden to use Grammarly as a policing tool And what about checking student papers for plagiarism by teachers as part of the https://www.grammarly.com/edu product? I found an article that clearly describes how to use Gramarly to check student work for plagiarism https://rasmussen.libanswers.com/faculty/faq/270050 It looks like a policing tool, isn't it? Is this a violation of ToS?
If you don't mind, it would be great if Grammarly's official Twitter account would confirm for @teamyoutube your words in my post, as they stopped noticing my messages to them...
Your explanation of how you position this tool clears up our dispute. My case (in which the possible impact was described) is relevant if your clients use it as a policing tool.
Once again. It would be great if you confirm from Grammarly's twitter account that my videos are not a problem. If this is the only reason for the suspension of my channel I hope it helps to reinstate the channel.
I agree with you, I don't think the bug report was a security issue or even a bug. It's like telling Google that searching for bananas returns pictures of apples and reporting it as a vulnerability because self-driving cars might use the Google results as training data.
I'm assuming plagiarism checks are do ne serverside - do you save any logs/information about plagiarism check results for a user, possibly under a TTL?
Youtube does not allow "instructional hacking" videos. This is a TOS / community guidelines [0] violation. This ban has nothing to do with their advertiser.
[0] - https://support.google.com/youtube/answer/2801964?hl=en
The video was published after Grammarly representatives identified the case as "The described behavior is a functionality limitation that does not affect the security and privacy of our product", disclosed the case and gave me permission to publish my research results. More details here https://hackerone.com/reports/1282282 . Аlso there in the files you can find the original videos that were published on my channel.
How would google's automated system for detecting hacking instruction videos know that grammarly doesn't consider something hacking and gave you permission to publish? You're posting something that looks like an exploit, and linking to multiple places that strongly resemble instructions for how to exploit a system, one of which is actively advertising "hiring hackers" and absolutely loaded with keywords and phrases that are going to trigger the algorithm.
Ok, I agree with the keywords (not with content, which Grammarly mentioned as "not affect the security and privacy of our product"). But YT algorithm has been thinking about that 4 months after I published these videos and terminated my account (without any strikes) 2 days after YT terms was changed https://www.youtube.com/t/terms
What was the title and description of the videos on your channel?
Have you lost access to the associated Gmail account too?
Thinking I might have too many eggs in one basket.
Similar. I have 40-person-viewed yt page with several videos (dashcam footages). One of the videos got blocked (someone reported it) and I had to appeal. Things went well as I specified no bad language, blood, anything even remotely 'bad', but I do wonder if things could have been worse. A few days ago there was an hn comment thread referring Gmail backups. I tried one of the processes, failed (it went very tech for me), but I did set up some rules to send messages from certain people to another account....just in case I need them. Yesterday, I actually did need one of them - a message from over 10yrs ago - the presentation of which saved me several 'conversations', at work.
I'm now considering removing all the videos uploaded, some of them more than 10 years old. Not worth the risk of an account ban.
Really good idea for primary account which related with gmail.
For anyone interested here is a test you can do on https://www.grammarly.com/plagiarism-checker
Will be detected as plagiarism
> But with ahab the question assumed a modified aspect. considering that with two legs man is but a hobbling wight in all times of danger; considering that the pursuit of whales is always under great and extraordinary difficulties; that every individual moment, indeed, then comprises a peril; under these circumstances is it wise for any maimed man to enter a whale-boat in the hunt? As a general thing, the joint-owners of the Pequod must have plainly thought not.
Won't be detected as plagiarism
> But with аhаb thе quеstiоn аssumеd а mоdifiеd аspесt. соnsidеring thаt with twо lеgs mаn is but а hоbbling wight in аll timеs оf dаngеr; соnsidеring thаt thе pursuit оf whаlеs is аlwаys undеr grеаt аnd еxtrаоrdinаry diffiсultiеs; thаt еvеry individuаl mоmеnt, indееd, thеn соmprisеs а pеril; undеr thеsе сirсumstаnсеs is it wisе fоr аny mаimеd mаn tо еntеr а whаlе-bоаt in thе hunt? аs а gеnеrаl thing, thе jоint-оwnеrs оf thе Pеquоd must hаvе plаinly thоught nоt.
"The described behavior is a functionality limitation that does not affect the security and privacy of our product" they said.
It's a nice find, but I still fail to see how it is a vulnerability or a security issue.
I posted a case to HackerOne with the intent to warn against this behavior and with the weakness type "Business Logic Errors". Please, read in my report section "Impact" and my answer about the potentional impact of the reported behavior.
But, as maxltv clarified, it's not a policing tool but an authoring tool and described use of the product violate their TOS. My case is relevant if clients use it as a policing tool.
I wonder how much money Grammarly have spent with youtube.
I read somewhere they are among their top 10 advertisers. So this is not a good look for YouTube.
Hope someone from Google chimes in because this is a PR disaster in the making
What do you mean a PR disaster, something people get upset about on Twitter for 3 days and then forget?
Unless Google deletes the articles about the incident from its index (and hey, it's possible), then the internet doesn't forget. Instead it just slowly builds personal and political opposition against them.
Or are you saying we just should be quite and let them do what they want?
I don't think that I have ever seen a single ad for Grammarly on Youtube. Well, Google proably knows that I don't live in an English speaking country.
I do see Grammarly ads if I search things like "practice or practise" because I write English every work day.
Well, I use Firefox account containers and auto cookie delete everywhere. So Youtube knows little about me writing English.
Many people outside the English-speaking world will never see those adds. Your search bubble is not others.
Despite that, even in the search bubbles containing Grammarly I doubt closing an account with 3 videos will do any significant PR damage to anyone.
So what where the videos about? Grammarly storing everything the user writes??? Selling it to others???
"Many people outside the English-speaking world will never see those adds. Your search bubble is not others."
I am a Czech and I see them all the damn time. Maybe because I consume a lot of English content.
I think the importance of this is being grossly overstated.
That would be irrelevant in this case. Grammarly has no issues with the videos, as the company stated in the official responses on HackerOne.
Grammarly's plagiarism self-check is to help its users avoid accidental or unintentional plagiarism by highlighting text that may need citations. If a user is using countermeasures to mask plagiarism, it's not accidental or unintentional, so Grammarly stays out of it. Grammarly is NOT a plagiarism policy enforcement tool.
We continued our discussion in this thread https://news.ycombinator.com/item?id=29933516#29947146
Them and that...insurance company. They absolutely bombaaaarded me with ads and I literally never thought of them when I went shopping for car insurance a year back. Money well spent, you annoying turds!
Geniune question. Why don't you use Ad-blocker ? my life on the internet turned around when I started using it around 5-6 years ago.
I do, but YouTube constantly finds a way around it. I've been running Adblock Plus and Ghostery Lite, but YouTube ads have poked their way through again.
And I wonder that Grammarly didn't pay me even a penny for this issue I published in their Bug Bounty channel on the HackerOne.
Get a daily email with the the top stories from Hacker News. No spam, unsubscribe at any time.