Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Bug Bounty – The $5k Error Page

slashcrypto.org

Post reply on HN
Print view View original

131–140 of 144 posts

Re: Google Bug Bounty – The $5k Error Page

#131

Post by logicallee »

falsedan wrote: post #125
logicallee wrote: post #62

Earlier quoted context omitted.

It's hard to believe, but years ago, back when Google had what was called "stop words" (like 'the', that it ordinarily ignored) I was able to make Google perform a search that took over 30 seconds. The reason stop words take such a long time is that millions of sites have words like "the" on them, so doing a join on all those simply takes a long time. My method to find a long string consisting entirely of stop words,…

Google never had stop words. The original lexicon only included the most popular 14 million words (for fast bucketing), and rare words were processed specially.

It did - I had to use plus signs to force them to use them.

Normally it ignored those words. I am fairly certain of this detail. I must have found a list of those words - how else would I have found the string "from what it is to a"? I had a list of its stop words.

Edit: for proof, here's someone's screenshot of the same - http://farm3.static.flickr.com/2270/2201828252_45a32da7f4.jp...

As you can see, it is Google saying it is ignoring a word because it is too common. It has a list of every site that has that, but that list is huge and it doesn't usually use it.

Re: Google Bug Bounty – The $5k Error Page

#132

Post by londons_explore »

developer2 wrote: post #98
ClassyJacket wrote: post #78

Earlier quoted context omitted.

>and he/she came into the thread to kindly ask us to stop messing up their statistics. Shouldn't someone with a job in statistics know how to account for outliers?

This particular issue was posted on Quora, where anyone could pick it up and participate in what is essentially a denial of service attack (whether or not performed intentionally). It wasn't submitted as a private bug report to Google so they could fix the issue. It was spread in a public forum. I think it's fair for Google to politely ask "a few of your own tests to validate an issue you will submit as a bug report…

Boss: Median latency is 100ms and 99.9th percentile latency is 1 second.

Nobody ever asks about that 0.1%...

Re: Google Bug Bounty – The $5k Error Page

#133

Post by illumin8 »

arkadiyt wrote: post #97
thaumasiotes wrote: post #61

Earlier quoted context omitted.

My favorite bug bounty report so far read, in its entirety, "try it ASAP".

I've received reports for things like "source code disclosure" where they link to our jQuery.

LOL - I'd like to report that I was able to download the entire source code of your website by right-clicking and selecting "View Page Source..."

Re: Google Bug Bounty – The $5k Error Page

#134

Post by kw71 »

ChuckMcM wrote: post #19

Nice catch. A long time ago the services on the backend were killed by a special URL. And someone found it, and it wasn't filtered by the front end. And of course someone tried to use it, but it never returns since it kills the service, but their client retried ... it was a lot of "what the heck is happening" going on until SRE figured it out and then they immediately patched the front end and the anomalies stopped.…

Something to show for effort. This matters a bit.

One of my young-adulthood colleagues went on to be an early googler who is influential in relevant policies. We built our relationship sharing bugs and analysis techniques. Quite a few years ago some scoundrels whose trust I gained proudly showed me how they were using youtube links to drop malware. Since my old mate worked there, I mentioned it and they were quite interested.

We hadn't shared anything in a while, both of us demonstrating loyalty to our employers and not talking about work details. I said that it would be really cool to have a one dollar check from Google for a bug report. I probably offered to send something cool from my workplace too.

They said, "We don't pay for bugs" Fifty cents? "We don't pay for bugs!"

I felt like I was simply after a piece of paper and the evildoers were a mildly useful source, but I could easily do without them and the souvenir would have been treasured.

I was unreasonably miffed that I couldn't get that piece of paper, though. So I reviewed the links I'd collected and passed some general information but withheld details that would be obviously unique to these attackers. They expressed disappointment with me the next time we spoke. It turns out that what I gave wasn't specific enough to easily identify the lame cross site exploit, despite my actual intent to lead them to the bug.

Interesting they have a bounty program now.

Re: Google Bug Bounty – The $5k Error Page

#135

Post by falsedan »

logicallee wrote: post #131
falsedan wrote: post #125

Earlier quoted context omitted.

Google never had stop words. The original lexicon only included the most popular 14 million words (for fast bucketing), and rare words were processed specially.

It did - I had to use plus signs to force them to use them. Normally it ignored those words. I am fairly certain of this detail. I must have found a list of those words - how else would I have found the string "from what it is to a"? I had a list of its stop words. Edit: for proof, here's someone's screenshot of the same - http://farm3.static.flickr.com/2270/2201828252_45a32da7f4.jp... As you can see, it is Google sa…

Stop words are words that are ignored when indexing, not when querying. Since you did find a result, those words must have been indexed.

Re: Google Bug Bounty – The $5k Error Page

#136

Post by rshaban »

vochinch wrote: post #63
carvalho wrote: post #58

Earlier quoted context omitted.

On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.

Nice! Do you still have the link to the Quora question or an example of the query?

linked in https://news.ycombinator.com/item?id=14372977

https://www.quora.com/What-is-the-slowest-Google-query

Re: Google Bug Bounty – The $5k Error Page

#138

Post by jcims »

sundvor wrote: post #95
dsacco wrote: post #37

Earlier quoted context omitted.

About 10:1 noise:signal. This comes from a variety of experiences: I used to manage a bug bounty for a mid-size company on Bugcrowd; in 2014 I surveyed people managing a bunch of programs across different sizes; I've participated in bug bounty programs for companies of different sizes. The more you offer for rewards and the more recognizable your company name, the more you will be spammed by people submitting reports…

~10% valid submissions still sounds like a fantastic number to me. Sure you have to sort out the bad ones, but it's still a solid stream of valid reports.

It's a pain when you're in the thick of it, but it really is a great way to round out your security program. There's an astonishing number of incredibly skilled and motivated folks out there, and a well-run bounty program can create a nice symbiotic relationship that benefits both.

One other thing that never really gets any press is the fact that a good chunk of the folks sending in reports are young people in impoverished nations. Some of them can be pretty tricky to deal with, but if you hold a hard line on professional expectations you can see them flourish in pretty short order to be some of the best reporters out there.

I only spent a short amount of time on the program I was with, but it was very rewarding. A+++, highly recommended.

Re: Google Bug Bounty – The $5k Error Page

#139

Post by thaumasiotes »

illumin8 wrote: post #133
arkadiyt wrote: post #97

Earlier quoted context omitted.

I've received reports for things like "source code disclosure" where they link to our jQuery.

LOL - I'd like to report that I was able to download the entire source code of your website by right-clicking and selecting "View Page Source..."

If only that were true... modern web pages frequently have basically nothing of any value in the page source; it's all dynamically loaded.

Re: Google Bug Bounty – The $5k Error Page

#140

Post by endgame »

developer2 wrote: post #130
endgame wrote: post #129

Earlier quoted context omitted.

One of the problems with ORMs is that because it lets people forget about the annoying details of their databases, it also makes the forget the useful details of their databases.

Damn you! I wrote a bloody essay in a reply[1] to explain, in superfluous detail, what you summarized in one sentence. Anyone with basic knowledge of the topic would know what you mean. I need to figure out this magic people like you possess. I'm tired of rambling, when nobody will read it. Thank you for the incentive to improve. [1] https://news.ycombinator.com/item?id=14374031

That's the kindest spontaneous compliment I've received in a while. Thank you. But: while the pithy comment might farm more imaginary internet points, the essay may actually teach a lesson to the person who doesn't yet get it.

As for writing: it's not magic, but for me it's not consciously applied processes either. If I had to guess how my earlier comment came about, I'd suggest something like this as a generative process:

1. Find two effects with a common cause (provided upthread). 2. State each effect, sharing words and rhythm to bring out contrast. 3. Omit needless words. (Thanks, Strunk/White!)

HTH.

Post reply on HN