Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Bug Bounty – The $5k Error Page

slashcrypto.org

Post reply on HN
Print view View original

81–90 of 144 posts

Re: Google Bug Bounty – The $5k Error Page

#81

Post by Benjammer »

logicallee wrote: post #76
Benjammer wrote: post #72

Earlier quoted context omitted.

>There's nothing to index Huh? What do you mean? Google indexes HTML web page content from the entire public internet using web crawlers...

I'm confused. By "clever indexing" I thought they meant, in the database sense of the word. The reason my search took 30 seconds is because it started by getting a list of every site with "from" on it, every site with "what" on it, and so on, intereseecting them all. That's how it ended up finding my quote. how else do you think it did it? ----- edit: to find the string "from what it is to a" which occurs only hidden…

I'm curious how else you think large-scale data is stored other than in an index in the database sense of the word as well. You think Google has some kind of massive heap-like, unstructured data-store that they run search queries against? That doesn't make sense to me, but I've also never worked in global scale web search, soooo idk.

Re: Google Bug Bounty – The $5k Error Page

#82

Post by wingerlang »

asperous wrote: post #31
Macuyiko wrote: post #5

So I was thinking recently... with Google (amongst others, of course) themselves pushing towards AI applications, it seems to me that many of these less-advanced* bounty hunts might perhaps be able to be automated with a fuzzer+scraper+AI based approach. The fact that bug bounties are still being awarded does suggest that this is not that trivial, however, but might still be fun to explore nonetheless. I.e. can one t…

I think that exists! It's called a vulnerability scanner. Maybe they could be smarter.

Wouldn't those simply scan and try for already known vulnerabilities? I think the point of the AI would be to look for unknown ones.

Re: Google Bug Bounty – The $5k Error Page

#83

Post by richforrester »

dsacco wrote: post #51
afpx wrote: post #48

Earlier quoted context omitted.

Curious why you have such high tolerance for this type of behavior, since it appears that you don't actually approve of it.

I can't speak for the parent, but I have a tolerance for it because I've actually managed bug bounty programs; I also know Google receives on the order of 100,000 bug bounty reports annually, while a full order of magnitude less are actually valid.

Similar. Experience tought me that having patience for bad situations leads to more understanding and easier solving of issues.

The fact is that the more people are involved in a process, the slower the cogs turn.

Having patience is more of a defense mechanism than it is anything else. It has served me well and made life easier!

Re: Google Bug Bounty – The $5k Error Page

#84

Post by teen »

logicallee wrote: post #67
sova wrote: post #64

Earlier quoted context omitted.

Is it really technically correct to say that Google was performing web-wide joins on data? Isn't it all about clever indexing?

There's nothing to index. How could it have found my Shakespeare quote via an index? It consisted entirely of words 'from what it is to a' but produced only the Shakespeare quote. I don't see how it could have indexed anything.... it must have done a join. (Which makes sense given the 30+ seconds I had to sit and wait before it returned its answer, while also reporting the time it took to produce it. What else could…

I think it indexes the entire string, no? or would that be too many combinatorics, idk.

Re: Google Bug Bounty – The $5k Error Page

#85

Post by andrewstuart2 »

logicallee wrote: post #67
sova wrote: post #64

Earlier quoted context omitted.

Is it really technically correct to say that Google was performing web-wide joins on data? Isn't it all about clever indexing?

There's nothing to index. How could it have found my Shakespeare quote via an index? It consisted entirely of words 'from what it is to a' but produced only the Shakespeare quote. I don't see how it could have indexed anything.... it must have done a join. (Which makes sense given the 30+ seconds I had to sit and wait before it returned its answer, while also reporting the time it took to produce it. What else could…

Google does index pages, in the database sense. An index in the database sense is nothing more than reorganizing data (or subsets of data) into structures optimized for searching and seeking, rather than full scans.

I'm guessing you're most familiar with btree indexes as present and default in many SQL solutions, which are good for quickly answering exact, greater/less matches. There are dozens of data structures useful for indexing, some of which are built to index full text documents. For an example, check out the gin and gist indexes in Postgres [1].

It's my understanding that database indexing and index compression was a primary differentiator Google excelled at from the beginning. They could beat others at fractions of the typical cost because they didn't need data centers to store and query huge quantities of documents.

Seriously, there's no way even Google could intersect the sets of all crawled web documents containing those individual words in 30 seconds, much less two seconds.

[1] https://www.postgresql.org/docs/current/static/textsearch-in...

Re: Google Bug Bounty – The $5k Error Page

#86

Post by ahiknsr »

dsacco wrote: post #65
carvalho wrote: post #58

Earlier quoted context omitted.

On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.

Do you have a link to that? I'd be interested in reading it his response and I can't see it by searching Quora.

https://www.quora.com/What-is-the-slowest-Google-query/answe...

Re: Google Bug Bounty – The $5k Error Page

#87

Post by chrismarlow9 »

asperous wrote: post #31
Macuyiko wrote: post #5

So I was thinking recently... with Google (amongst others, of course) themselves pushing towards AI applications, it seems to me that many of these less-advanced* bounty hunts might perhaps be able to be automated with a fuzzer+scraper+AI based approach. The fact that bug bounties are still being awarded does suggest that this is not that trivial, however, but might still be fun to explore nonetheless. I.e. can one t…

I think that exists! It's called a vulnerability scanner. Maybe they could be smarter.

Its called a fuzzer. many of them have plugin frameworks where you can tensorflow your heart out.

Re: Google Bug Bounty – The $5k Error Page

#88

Post by lucb1e »

netheril96 wrote: post #54

Such a refreshing story after countless of security researchers get threatened or sued when they report security vulnerabilities to the company that should have thanked them instead.

Haven't read one of those in years. Did one come by on HN recently?

Re: Google Bug Bounty – The $5k Error Page

#89

Post by chrismarlow9 »

em3rgent0rdr wrote: post #59
komali2 wrote: post #27

Earlier quoted context omitted.

I'm similarly surprised we haven't heard of a AI augmented fuzzer that's been unleashed on random domains to just "try shit out." Seems like a good way to find weird little bugs. Then again, the scope of the "problem" is so massive, and the "rewards" (shit to flag as "yea check this out more") so vague, I don't even know how you'd begin.

If the good people don't do it soon, the bad people will...

not really, there's enough bad schemes that already work to bother with fancy technical exploits

Re: Google Bug Bounty – The $5k Error Page

#90

Post by lucb1e »

dsacco wrote: post #49
mickrussom wrote: post #47

Earlier quoted context omitted.

Try arguing with them about an SLA violation they had with their cloud infrastructure. The game is setup where they can chisel and have these guffaw and aw garsh moments but every adword and every billable second on their cloud will get paid hell or high water.

Did you seriously come to hijack a story about a Google bug bounty so you could complain about an irrelevant issue?

If I'm being completely fair, how often does HN as a whole discuss related topics or cases in the comment thread? The best example is probably that people kept mentioning Reader shutting down whenever they launched something new, a la "not going to use this, see what they did to Reader".

Not sure it's entirely the same as this case, but hijacking threads with "remember when this happened?" is not that unique.

Post reply on HN