Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Bug Bounty – The $5k Error Page

slashcrypto.org

Post reply on HN
Print view View original

141–144 of 144 posts

Re: Google Bug Bounty – The $5k Error Page

#141

Post by developer2 »

londons_explore wrote: post #132
developer2 wrote: post #98

Earlier quoted context omitted.

This particular issue was posted on Quora, where anyone could pick it up and participate in what is essentially a denial of service attack (whether or not performed intentionally). It wasn't submitted as a private bug report to Google so they could fix the issue. It was spread in a public forum. I think it's fair for Google to politely ask "a few of your own tests to validate an issue you will submit as a bug report…

Boss: Median latency is 100ms and 99.9th percentile latency is 1 second. Nobody ever asks about that 0.1%...

When that 0.1% - or even 0.001% - are 5-60 second requests, you have a bomb waiting to go off. There really is a massive difference when you are operating at the scale of Google. If the median is 100ms, the maximum acceptable time - 100th percentile - is likely below 200ms. A three nines percentile that is 10x the median isn't a good thing at large scale. Perfect consistency is more important than statistics. A small scale service deployed on my-little-unused-tool.com that receives a few requests/minute is an entirely different ballgame.

Re: Google Bug Bounty – The $5k Error Page

#142

Post by _ao789 »

slazaro wrote: post #119
_ao789 wrote: post #117

Earlier quoted context omitted.

Both a 'he' and a 'she'. Is that what it takes to pass the whiteboard b-tree reversal interviews these days?

It's Schrödinger's gender, it's both when unknown, until revealed.

No post body was provided.

Re: Google Bug Bounty – The $5k Error Page

#143

Post by sundvor »

jcims wrote: post #138
sundvor wrote: post #95

Earlier quoted context omitted.

~10% valid submissions still sounds like a fantastic number to me. Sure you have to sort out the bad ones, but it's still a solid stream of valid reports.

It's a pain when you're in the thick of it, but it really is a great way to round out your security program. There's an astonishing number of incredibly skilled and motivated folks out there, and a well-run bounty program can create a nice symbiotic relationship that benefits both. One other thing that never really gets any press is the fact that a good chunk of the folks sending in reports are young people in impove…

That's great about the young people! Thanks for relating this.

Re: Google Bug Bounty – The $5k Error Page

#144

Post by RugnirViking »

logicallee wrote: post #62
carvalho wrote: post #58

Earlier quoted context omitted.

On Quora someone asked what the longest search query time was. I was able to craft a query that took multiple seconds to complete. It used wildcards and undocumented iteration allowing one to stuff thausands of queries into a single query. Turns out it is someone's job to measure result response times, and he/she came into the thread to kindly ask us to stop messing up their statistics.

It's hard to believe, but years ago, back when Google had what was called "stop words" (like 'the', that it ordinarily ignored) I was able to make Google perform a search that took over 30 seconds. The reason stop words take such a long time is that millions of sites have words like "the" on them, so doing a join on all those simply takes a long time. My method to find a long string consisting entirely of stop words,…

I managed to beat that query with "The thing is what it is"
Post reply on HN