Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Bug Bounty – The $5k Error Page

slashcrypto.org

Post reply on HN
Print view View original

61–70 of 144 posts

Re: Google Bug Bounty – The $5k Error Page

#61

Post by thaumasiotes »

dsacco wrote: post #37
daddyo wrote: post #35

Earlier quoted context omitted.

What's the general signal to noise ratio for bug reports?

About 10:1 noise:signal. This comes from a variety of experiences: I used to manage a bug bounty for a mid-size company on Bugcrowd; in 2014 I surveyed people managing a bunch of programs across different sizes; I've participated in bug bounty programs for companies of different sizes. The more you offer for rewards and the more recognizable your company name, the more you will be spammed by people submitting reports…

My favorite bug bounty report so far read, in its entirety, "try it ASAP".

Re: Google Bug Bounty – The $5k Error Page

#62

Post by logicallee »

carvalho wrote: post #58
ChuckMcM wrote: post #19

Nice catch. A long time ago the services on the backend were killed by a special URL. And someone found it, and it wasn't filtered by the front end. And of course someone tried to use it, but it never returns since it kills the service, but their client retried ... it was a lot of "what the heck is happening" going on until SRE figured it out and then they immediately patched the front end and the anomalies stopped.…

On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.

It's hard to believe, but years ago, back when Google had what was called "stop words" (like 'the', that it ordinarily ignored) I was able to make Google perform a search that took over 30 seconds.

The reason stop words take such a long time is that millions of sites have words like "the" on them, so doing a join on all those simply takes a long time.

My method to find a long string consisting entirely of stop words, was to just download a project gutenberg of the complete works of shakespeare, and find the longest string consisting of just stop words in there, then search for it as a literal quote.

The longest one I found was: "From what it is to a".

Let me see how long Google takes to do it now :)

2.04 seconds! Nice :) - http://i.imgur.com/IhPTpr6.png

that took 30+ seconds 'back in the day'.

Re: Google Bug Bounty – The $5k Error Page

#63

Post by vochinch »

carvalho wrote: post #58
ChuckMcM wrote: post #19

Nice catch. A long time ago the services on the backend were killed by a special URL. And someone found it, and it wasn't filtered by the front end. And of course someone tried to use it, but it never returns since it kills the service, but their client retried ... it was a lot of "what the heck is happening" going on until SRE figured it out and then they immediately patched the front end and the anomalies stopped.…

On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.

Nice! Do you still have the link to the Quora question or an example of the query?

Re: Google Bug Bounty – The $5k Error Page

#64

Post by sova »

logicallee wrote: post #62
carvalho wrote: post #58

Earlier quoted context omitted.

On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.

It's hard to believe, but years ago, back when Google had what was called "stop words" (like 'the', that it ordinarily ignored) I was able to make Google perform a search that took over 30 seconds. The reason stop words take such a long time is that millions of sites have words like "the" on them, so doing a join on all those simply takes a long time. My method to find a long string consisting entirely of stop words,…

Is it really technically correct to say that Google was performing web-wide joins on data? Isn't it all about clever indexing?

Re: Google Bug Bounty – The $5k Error Page

#65

Post by dsacco »

carvalho wrote: post #58
ChuckMcM wrote: post #19

Nice catch. A long time ago the services on the backend were killed by a special URL. And someone found it, and it wasn't filtered by the front end. And of course someone tried to use it, but it never returns since it kills the service, but their client retried ... it was a lot of "what the heck is happening" going on until SRE figured it out and then they immediately patched the front end and the anomalies stopped.…

On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.

Do you have a link to that? I'd be interested in reading it his response and I can't see it by searching Quora.

Re: Google Bug Bounty – The $5k Error Page

#66

Post by SamBam »

logicallee wrote: post #62
carvalho wrote: post #58

Earlier quoted context omitted.

On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.

It's hard to believe, but years ago, back when Google had what was called "stop words" (like 'the', that it ordinarily ignored) I was able to make Google perform a search that took over 30 seconds. The reason stop words take such a long time is that millions of sites have words like "the" on them, so doing a join on all those simply takes a long time. My method to find a long string consisting entirely of stop words,…

Interestingly, I wonder if it cached your query.

My same query as you took 0.3s, but if I stripped out one word ("From what it is to") it took 2.2 seconds.

Re: Google Bug Bounty – The $5k Error Page

#67

Post by logicallee »

sova wrote: post #64
logicallee wrote: post #62

Earlier quoted context omitted.

It's hard to believe, but years ago, back when Google had what was called "stop words" (like 'the', that it ordinarily ignored) I was able to make Google perform a search that took over 30 seconds. The reason stop words take such a long time is that millions of sites have words like "the" on them, so doing a join on all those simply takes a long time. My method to find a long string consisting entirely of stop words,…

Is it really technically correct to say that Google was performing web-wide joins on data? Isn't it all about clever indexing?

There's nothing to index. How could it have found my Shakespeare quote via an index? It consisted entirely of words 'from what it is to a' but produced only the Shakespeare quote. I don't see how it could have indexed anything.... it must have done a join. (Which makes sense given the 30+ seconds I had to sit and wait before it returned its answer, while also reporting the time it took to produce it. What else could it have been doing?)

By the way I believe I wanted to know whether it would return the Shakespeare quote at all.

If you mean that it might have cached the results of the query, I doubt anyone else queried that exact phrase, other than me.

Re: Google Bug Bounty – The $5k Error Page

#68

Post by logicallee »

SamBam wrote: post #66
logicallee wrote: post #62

Earlier quoted context omitted.

It's hard to believe, but years ago, back when Google had what was called "stop words" (like 'the', that it ordinarily ignored) I was able to make Google perform a search that took over 30 seconds. The reason stop words take such a long time is that millions of sites have words like "the" on them, so doing a join on all those simply takes a long time. My method to find a long string consisting entirely of stop words,…

Interestingly, I wonder if it cached your query. My same query as you took 0.3s, but if I stripped out one word ("From what it is to") it took 2.2 seconds.

of course it cached my query. :) try it again in a few weeks.

Re: Google Bug Bounty – The $5k Error Page

#69

Post by microcolonel »

terminalcommand wrote: post #7
rprime wrote: post #2

I discovered the same error/bug a few weeks ago when a co-worker linked "this weird page" to me, I just looked around and thought it's pretty cool too see that part of Google and didn't thought too much of it, closed the tab and went back to my Terminal. :)

I am a bit jealous :). I also did a subdomain search on google a few weeks ago. I stumbled upon a lot of login sites. A subdomain search leaded to 95 subdomains under corp.google.com. There is some strange javascript in those pages, there is a function called riskMi. I don't want to get sucked into it, I'm also closing the tab and going back to my terminal :).

riskMi is probably from CA Technologies RiskMinder™.

Re: Google Bug Bounty – The $5k Error Page

#70

Post by microcolonel »

komali2 wrote: post #25

Offtopic: What's with the hyper narrow width on this page? Looks like this on a 1440p monitor (ubuntu, chrome) http://i.imgur.com/m9YWcNj.png

I prefer narrow columns for reading personally. Snap the article window to the side and scale it down for maximum enjoyment.
Post reply on HN