In other words — assuming you’re not a YouTube Premium subscriber — ‘youtube.com/reallycoolvideo’ will show ads, but ‘youtube.com./reallycoolvideo’ will not. It’s that simple. The bug is mostly limited to desktop browsers, but on mobile, you can use the ‘Request Desktop Site’ option in order for the trick to work. Redditor u/unicorn4sale noted the bug on Reddit’s r/webdev subreddit. According to u/unicorn4sale: “It’s a commonly forgotten edge case, websites forget to normalize the hostname, the content is still served, but there’s no hostname match on the browser so no cookies and broken CORS – and lots of bigger sites use a different domain to serve ads/media with a whitelist that doesn’t contain the extra dot” In other words, it’s a simple oversight — and it’s far from just YouTube. A quick test showed it to be effective at getting past paywalls for The New York Times, Wired, The Washington Post, The Atlantic, and several others. Of course, now that the bug is out in the open, it’s only a matter of time before this little loophole is closed. Enjoy it while it lasts — or, you know, pay up. Via Android Central
