diff options
Diffstat (limited to 'Docs/SECURITY-FAQ.md')
| -rw-r--r-- | Docs/SECURITY-FAQ.md | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/Docs/SECURITY-FAQ.md b/Docs/SECURITY-FAQ.md index d7f11a9..dfbbbca 100644 --- a/Docs/SECURITY-FAQ.md +++ b/Docs/SECURITY-FAQ.md @@ -12,7 +12,7 @@ Yes. When you dislike a video, we create a randomly generated unique ID for you ### What information do you have, exactly? -Just the video ID. Not your comments, not your username, not who you've shared the video with, not any additional metadata. Nothing. Just the video ID. +Just the video ID. Not your comments, not your username, not who you've shared the video with, not any additional metadata. Nothing. Just the video ID. ### How is my IP stored? @@ -20,13 +20,12 @@ The backend keeps unhashed IP addresses in volatile memory (RAM) only. These add ### I heard some discussion over OAuth, and access to my YouTube account! -This feature will be optional, and very much opt-in. If you are a YouTube creator, and would like to share your dislike stats with us, you can. The way [OAuth](https://en.wikipedia.org/wiki/OAuth#:~:text=but%20without%20giving%20them%20the%20passwords.) was structured, it's actually very secure. You can revoke access to your account at any time, and can give very specific permissions to us. We will not ask for any permissions that aren't required. We'll only ask for permissions to view your video stats. +This feature will be optional, and very much opt-in. If you are a YouTube creator, and would like to share your dislike stats with us, you can. The way [OAuth](https://en.wikipedia.org/wiki/OAuth#:~:text=but%20without%20giving%20them%20the%20passwords.) was structured, it's actually very secure. You can revoke access to your account at any time, and can give very specific permissions to us. We will not ask for any permissions that aren't required. We'll only ask for permissions to view your video stats. ### How can I trust this dislike count? We have implemented measures to prevent bot attacks and are gonna continue to work on improving the effectiveness of the bot prevention system: this will help us keep the dislike count as a good representative of the actual count. Of course it will never be 100% accurate so it's up to you to decide whether you trust the count or not. -### Why don't you share the backend code? +### Why don't you share the backend code? We will share it at some point - but there's really no real reason to share it right now. It gives a false sense of security - because in a zero-trust system, we could just as well disclose one version but deploy another. There are plenty of reasons to keep the code hidden, specifically, how we battle spam. Hiding/Obfuscating the spam handling code is a fairly standard practice. - |