@YouTube gurus...HttpWebrequest

They don't even need to use the http protocol, there are multiple ways for them to signal their server that a request has been made; your flash player can be made to work like a tcp sockets client that can connect to any outbound port that isn't filtered by your firewall. They can essentially turn it into a fully functional email client (or any other tcp client) if they wanted to, without you noticing anything unusual.
I was actually wondering why they haven't done this a while back. Oh well :)
 
They don't even need to use the http protocol, there are multiple ways for them to signal their server that a request has been made; your flash player can be made to work like a tcp sockets client that can connect to any outbound port that isn't filtered by your firewall. They can essentially turn it into a fully functional email client (or any other tcp client) if they wanted to, without you noticing anything unusual.

This is all possible, but is there anyway to check for what your saying? And how do we know YouTube aren't already doing this?
 
They don't even need to use the http protocol, there are multiple ways for them to signal their server that a request has been made; your flash player can be made to work like a tcp sockets client that can connect to any outbound port that isn't filtered by your firewall. They can essentially turn it into a fully functional email client (or any other tcp client) if they wanted to, without you noticing anything unusual.
They aren't really directly making HTTP request, but rather making requests via the browser. This possibly reduces security issues/warnings and any proxy settings being used by the browser will affect the stats request. The fact that you can capture these packets with a firefox plugin proves this. If it was making independent HTTP requests, the plugin wouldn't be able to capture them and you will need wireshark to see them.
 
This is all possible, but is there anyway to check for what your saying? And how do we know YouTube aren't already doing this?
Like izSpK said, they don't currently do that and you can easily check it with wireshark. My point was that the possibilities are endless, and http isn't even required.
 
Back
Top