Are you sure you want to leave YouTube? (opens in new tab)

> Classic software:

    Primary CTA: what’s best for you
    Secondary CTA: an alternative for you

> Modern software:

    Primary CTA: what’s best for us
    Secondary CTA: what’s acceptable to us

> It seems like everywhere I go, software is increasingly designed against me.

It's been a long time since Windows 95's "Where do you want to go today?" slogan. Now, every developer's slogan is "Here's where we allow you to go today--and we'll make it hard to go anywhere else."

A related one is all the various nags on consumer software that won't take NO for an answer.

Do you want to rate our app?

Later [YES]

It is extremely disrespectful as it basically ignores consent. It's the "rapist mentality" Louis Rossmann talks about. No means no，not "later", people.

Lately Google's image search started to do the same some time ago. Click on an image, and then on the link beneath the image - it first opens a redirection notice which needs to be confirm. Acting like it's something unusual to click on a link from a search result screen...

Probably because YouTube allows purchases of various stuff. A phishing link could likely easily be made to look exactly like YouTube

This is a common pattern to see today. Lots of examples that maintain the same CTA design (don't leave us. Don't waste your money on scammers, waste them on us please)

Everybody's got a party and if you leave, you ruin the party -- apparently. Isolated "walled gardens" are a kind of Intranet. Ingress requires buy-in (sign up, log in, identity proof, human proof); leaving means breaking out to the more transparent, connected internet, which is a big problem when data is dollars.

Maybe I'm reading too much into it. More and more patterns seem hostile, antagonistic to the user, and it seems like it's an adopted practice that's taken as a standard. I hope I'm wrong.

I can only reproduce this when the link is opened in a different session than it was generated in. Maybe some vulnerability they're trying to mitigate? No idea what it would be though.

I gave up after reels were integrated and channelblocker broke. I dont think there is another website that had as big a shift from user focused to user hostile as youtube.

What's happening here is that Google wants to spy on which links you click and track your activity on that site by explicitly setting new cookies in the link's new tab from the URL params (re-bootstrapping a tracking cookie/etc to defeat opening it in an isolated tab or private browsing window), so they rewrite all links to point to their redirector endpoint.

Such an endpoint is vulnerable to "open redirect" exploits, where a redirect exploit on a trusted domain (google.com/youtube.com) is used to conceal a malicious link. The confirmation page is used to make the endpoint useless for such purposes.

But the confirmation page would be super annoying for normal users who intended to click the link, so there's a further mechanism where the redirector link has some ID that's also present in your cookies, so that as long as it is you who hits the redirector endpoint the confirmation page is bypassed - but if you try to use it in an "open redirect" attack your victim wouldn't have the matching cookie and thus would get the warning.

In their case they must be opening the link in a new context that doesn't share state (cookies/etc) with the old one (either deliberately or as a result of a privacy plug-in/feature) and so get the interstitial.