486
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 21 Nov 2023
486 points (98.6% liked)
Firefox
17302 readers
285 users here now
A place to discuss the news and latest developments on the open-source browser Firefox
founded 4 years ago
MODERATORS
That's out of context. That snippet of code existing is not sufficient to understand when does that part of the code gets actually executed, right?
For all we know, that might have been taken from a piece of logic like this that adds the delay only for specific cases:
It's possible that
complex_obfuscated_logic_to_discriminate_users
has some logic that changes based on user agent.And I expect it's likely more complex than just one if-else. I haven't had the time to check it myself, but there's probably a mess of extremely hard to read obfuscated code as result of some compilation steps purposefully designed to make it very hard to properly understand when are some paths actually being executed, as a way to make tampering more difficult.
The code is not obfuscated. The person i linked to even formatted it nicely. I do not have the time or energy to go through all of youtube's JS. But the 5s everyone is talking about does target every browser the same. Serverside the code isn't altered based on browser detection.
It can be formatted "nicely" with no issue. But that doesn't necessarily make it easy to understand.
What that person posted was in a function named
smb()
that only gets called byrmb()
under certain conditions, andrmb()
gets called byAdB()
under other conditions after being called fromeeB()
used inBaP()
.... it's a long list of hard to read minified functions and variables in a mess of chained calls, declared in an order that doesn't necessarily match up with what you'd expect would be the flow.In the same file you can also easily find references to the user agent being read at multiple points, sometimes storing it in variables with equally esoteric short names that might sneak past the reader if they aren't pedantic enough.
Like, for example, there's this function:
Searching for
vc()
gives you 56 instances in that file, often compared to some strings to check what browser the user is using. And that's just one of the methods where the userAgent is obtained, there's also ayc=Yba?Yba.userAgentData||null:null;
later on too... and several direct uses of bothuserAgent
anduserAgentData
.And I'm not saying that the particular instance that was pointed out was the cause of the problem.. it's entirely possible that the issue is somewhere else... but my point is that you cannot point to a snippet of "nicely formated" messed up transpiler output without really understanding fully when does it get called and expect to draw accurate conclusions from it.