Hacker Blogs
Work in progress: 181,232 of 181,233 sites checked so far, more every week · updated 2 Nov 2026Missing a blog? Tell us

Top all-time · #5500

D

David Schütz

Personal blog · bugs.xdavidhu.mesecurityprogramming

David Schütz's personal blog at bugs.xdavidhu.me covers security and programming. Since 2020, 14 different Hacker News readers have linked it 18 times, most often “The embedded YouTube player told me what you were watching”. It is still writing: the last post was on 2026-03-23, and you can follow it by feed.

Visit the blog
18mentions?
14HN people?
2020–2026first – last linked?
Links on Hacker News per year · peak 6 in 2021

Too few sampled comments (4) to say how often HN recommends it.?

Why HN links it

HN readers link David Schütz's security write-ups on Google bugs, such as a Google-wide domain check bypass and the embedded YouTube player leak, as related examples of URL parsing and Google vulnerabilities.

Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.

David Schütz's bug bounty writeups

Most-linked posts?

  1. The embedded YouTube player told me what you were watching
    3 people · 3 mentions · first linked 2021-01-18
  2. The unexpected Google wide domain check bypass
    3 people · 3 mentions · first linked 2020-03-09
  3. Accidental Google Pixel Lock Screen Bypass
    3 people · 3 mentions · first linked 2022-11-10
  4. Fixing the Unfixable: Story of a Google Cloud SSRF
    2 people · 3 mentions · first linked 2022-01-01
  5. Stealing Your Private YouTube Videos, One Frame at a Time
    2 people · 2 mentions · first linked 2021-01-11
  6. I Built a TV That Plays All of Your Private YouTube Videos
    2 people · 2 mentions · first linked 2021-04-05
  7. Running Tesla Model 3's Computer on My Desk Using Parts from Crashed Cars
    2 people · 2 mentions · first linked 2026-03-23

What Hacker News says?

  1. dnpp123 · 2020-03-12
    Thanks. Sourcegraph seems better from my 1mn test ? Following this article https://bugs.xdavidhu.me/google/2020/03/08/the-unexpected-go... recently featured on HN, I tried https://cs.opensource.google/search?q=%2F%5E(%3F:(%5B%5E:%2F... : no result https://sourcegraph.com/search?q=/%5E%28%3F:%28%5B%5E:/%3F%2... : 2 results !

    Comment linking /google/2020/03/08/the-unexpected-google-wide-domain-check-bypass/

    on “Google Open Source Code Search”
  2. BXWPU · 2022-11-10

    Submitted Accidental Google Pixel Lock Screen Bypass as a story · 1592 points

    HN discussion
  3. djrogers · 2021-01-18
    This is a bad link, not sure how it got upvoted when following it fails (there’s a trailing . after the domain). That’s kinda fishy... Correct link should be https://bugs.xdavidhu.me/google/2021/01/18/the-embedded-yout...

    Comment linking /google/2021/01/18/the-embedded-youtube-player-told-me-what-you-were-watching-and-more/

    on “The embedded YouTube player told me what you were watching”
  4. gbrown_ · 2021-01-11

    Submitted Stealing Your Private YouTube Videos, One Frame at a Time as a story · 1245 points

    HN discussion
  5. lioeters · 2020-04-16
    Reading that point reminded me of a recent article where a security researcher found an exploit due to the URL parser in Safari: Unauthorized access to cameras in Safari on macOS and iOS - https://www.ryanpickren.com/webcam-hacking And another one related to URL parsing: The unexpected Google wide domain check bypass - https://bugs.xdavidhu.me/google/2020/03/08/the-unexpected-go...

    Comment linking /google/2020/03/08/the-unexpected-google-wide-domain-check-bypass/

    on “Git: Newline injection in credential helper protocol”
  6. notRobot · 2020-03-09

    Submitted The unexpected Google wide domain check bypass as a story · 644 points

    HN discussion
  7. x0x0 · 2023-09-25
    There's already an unpatched full login bypass https://bugs.xdavidhu.me/google/2022/11/10/accidental-70k-go...

    Comment linking /google/2022/11/10/accidental-70k-google-pixel-lock-screen-bypass/

    on “Pixel 8 leak promises 7 years of OS updates–even more than an iPhone”
  8. hackerpain · 2021-01-18

    Submitted The embedded YouTube player told me what you were watching as a story · 260 points

    HN discussion
  9. mooreds · 2022-01-08

    Submitted Fixing the Unfixable: Story of a Google Cloud SSRF as a story · 137 points

    HN discussion
  10. driesdep · 2026-03-25

    Submitted Running Tesla Model 3's Computer on My Desk Using Parts from Crashed Cars as a story · 23 points

    HN discussion
  11. xdavidhu · 2022-01-01

    Submitted Fixing the Unfixable: Story of a Google Cloud SSRF as a story · 11 points

    HN discussion
  12. arkadiyt · 2021-04-06

    Submitted I Built a TV That Plays All of Your Private YouTube Videos as a story · 4 points

    HN discussion
  13. xdavidhu · 2026-03-23

    Submitted Running Tesla Model 3's Computer on My Desk Using Parts from Crashed Cars as a story · 3 points

    HN discussion
  14. wastedbrains · 2023-06-22

    Submitted Stealing Your Private YouTube Videos, One Frame at a Time as a story · 3 points

    HN discussion
  15. gbrown_ · 2021-04-05

    Submitted I Built a TV That Plays All of Your Private YouTube Videos as a story · 2 points

    HN discussion
  16. gbrown_ · 2021-01-18

    Submitted The Embedded YouTube Player Told Me What You Were Watching (and More) as a story · 2 points

    HN discussion
  17. Jacobinski · 2026-03-26

    Submitted Accidental $70k Google Pixel Lock Screen Bypass as a story · 1 points

    HN discussion
  18. mooreds · 2022-01-02

    Submitted Fixing the Unfixable: Story of a Google Cloud SSRF as a story · 1 points

    HN discussion

Search all of HN for bugs.xdavidhu.me

Linked by the same people?