Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Bug Bounty – The $5k Error Page

slashcrypto.org

Post reply on HN
Print view View original

71–80 of 144 posts

Re: Google Bug Bounty – The $5k Error Page

#71

Post by robbiemitchell »

daddyo wrote: post #35
jcims wrote: post #33

Earlier quoted context omitted.

Having worked on a large bounty program myself, and having at least one thing blow up because I dropped the ball on a response, I'll just say that the front-end aspect of it can be extremely chaotic. This guy seems like he's pretty polite and patient, which you generally try to reward with a rapid response and high touch, but sometimes you can get overwhelmed with a burst of reports, distracted by problematic reporte…

What's the general signal to noise ratio for bug reports?

Is there a ticketing system of some kind in play there? I imagine there would be steps like "Respond to user" before resolving/closing.

Re: Google Bug Bounty – The $5k Error Page

#72

Post by Benjammer »

logicallee wrote: post #67
sova wrote: post #64

Earlier quoted context omitted.

Is it really technically correct to say that Google was performing web-wide joins on data? Isn't it all about clever indexing?

There's nothing to index. How could it have found my Shakespeare quote via an index? It consisted entirely of words 'from what it is to a' but produced only the Shakespeare quote. I don't see how it could have indexed anything.... it must have done a join. (Which makes sense given the 30+ seconds I had to sit and wait before it returned its answer, while also reporting the time it took to produce it. What else could…

>There's nothing to index

Huh? What do you mean? Google indexes HTML web page content from the entire public internet using web crawlers...

Re: Google Bug Bounty – The $5k Error Page

#74

Post by Buge »

rprime wrote: post #2

I discovered the same error/bug a few weeks ago when a co-worker linked "this weird page" to me, I just looked around and thought it's pretty cool too see that part of Google and didn't thought too much of it, closed the tab and went back to my Terminal. :)

A few weeks ago? It says a temporary fix was done by February 10.

Re: Google Bug Bounty – The $5k Error Page

#75

Post by Buge »

dsacco wrote: post #52
mickrussom wrote: post #42

Nice , glad he got paid. Whats truly sad is they did try to chisel him out of his bounty if you read the timeline, he had to prod them to get his bounty. Can any of these top-ten companies that make like 200 million per day (google/alphabet, amazon, microsoft) ever do anything in good faith? One time google stiffed me initially on an RMA with a nexus phone until I stamped my feet a bit complaining that a company that…

I wish I could flag this. There's invariably one comment like this on bug bounty stories here. One comment that isn't happy with the bug bounty result even when the researcher is and goes off the rails with a weird anti-large company bias and some conspiracy. This has absolutely nothing to do with your Nexus RMA story, or your cloud SLA story from downthread, or whatever other agenda you have against these large comp…

Some companies do worse than attempt to cheat people out of rewards: they threaten to sue them. But Google doesn't do that.

Re: Google Bug Bounty – The $5k Error Page

#76

Post by logicallee »

Benjammer wrote: post #72
logicallee wrote: post #67

Earlier quoted context omitted.

There's nothing to index. How could it have found my Shakespeare quote via an index? It consisted entirely of words 'from what it is to a' but produced only the Shakespeare quote. I don't see how it could have indexed anything.... it must have done a join. (Which makes sense given the 30+ seconds I had to sit and wait before it returned its answer, while also reporting the time it took to produce it. What else could…

>There's nothing to index Huh? What do you mean? Google indexes HTML web page content from the entire public internet using web crawlers...

I'm confused. By "clever indexing" I thought they meant, in the database sense of the word.

The reason my search took 30 seconds is because it started by getting a list of every site with "from" on it, every site with "what" on it, and so on, intereseecting them all. That's how it ended up finding my quote. how else do you think it did it?

----- edit:

to find the string "from what it is to a" which occurs only hidden in the middle of shaespeare's texts -- what do you think they do?

In my opinion they combine the list of sites that have every word - starting with the least common ones. It's easier if you search for something that has a few uncommon words. Then you start with a small list, and have to combine it with other small lists.

When every word in the phrase has billions of sites (there are billions of pages that have the word "to" on them, same for "from", "what", "it", "is", "a"), you have to combine them all. Then you have to do a string search within the resulting set, since I put it in quotation marks. There is no easy strategy. Hence the long search time.

what else could they be doing?

Re: Google Bug Bounty – The $5k Error Page

#77

Post by Buge »

ncal wrote: post #26

"forgot"

What do you think the motivation would be to intentionally "forget"? To save money? If that's the motivation why not pay the reporter $500 instead of $5000 for a small info leak. It's illogical that they would intentionally "forget" then pay such a high bounty.

Re: Google Bug Bounty – The $5k Error Page

#78

Post by ClassyJacket »

carvalho wrote: post #58
ChuckMcM wrote: post #19

Nice catch. A long time ago the services on the backend were killed by a special URL. And someone found it, and it wasn't filtered by the front end. And of course someone tried to use it, but it never returns since it kills the service, but their client retried ... it was a lot of "what the heck is happening" going on until SRE figured it out and then they immediately patched the front end and the anomalies stopped.…

On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.

>and he/she came into the thread to kindly ask us to stop messing up their statistics.

Shouldn't someone with a job in statistics know how to account for outliers?

Re: Google Bug Bounty – The $5k Error Page

#79

Post by Benjammer »

logicallee wrote: post #76
Benjammer wrote: post #72

Earlier quoted context omitted.

>There's nothing to index Huh? What do you mean? Google indexes HTML web page content from the entire public internet using web crawlers...

I'm confused. By "clever indexing" I thought they meant, in the database sense of the word. The reason my search took 30 seconds is because it started by getting a list of every site with "from" on it, every site with "what" on it, and so on, intereseecting them all. That's how it ended up finding my quote. how else do you think it did it? ----- edit: to find the string "from what it is to a" which occurs only hidden…

You said "There's nothing to index," as if Google is making web requests to every domain in existence, parsing the document responses, and seeing which sites have these words on them, all at runtime when you type a search query. Google obviously indexes the web in the sense that they store their own cached versions of web pages "locally," on top of which they then build an insanely complicated, web-facing, search architecture.

Re: Google Bug Bounty – The $5k Error Page

#80

Post by logicallee »

Benjammer wrote: post #79
logicallee wrote: post #76

Earlier quoted context omitted.

I'm confused. By "clever indexing" I thought they meant, in the database sense of the word. The reason my search took 30 seconds is because it started by getting a list of every site with "from" on it, every site with "what" on it, and so on, intereseecting them all. That's how it ended up finding my quote. how else do you think it did it? ----- edit: to find the string "from what it is to a" which occurs only hidden…

You said "There's nothing to index," as if Google is making web requests to every domain in existence, parsing the document responses, and seeing which sites have these words on them, all at runtime when you type a search query. Google obviously indexes the web in the sense that they store their own cached versions of web pages "locally," on top of which they then build an insanely complicated, web-facing, search arc…

we're talking past each other. sova referred to this meaning - https://en.wikipedia.org/wiki/Database_index when they said "clever indexing."

the sense you mean is a different sense of the word index - meaning, to crawl. Yes, of course it does that too.

Post reply on HN