Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remove any Site From Google (even if you don't control it)

jamesbreckenridge.co.uk

Post reply on HN
Print view View original

11–20 of 102 posts

Re: Remove any Site From Google (even if you don't control it)

#11

Post by juliano_q »

DrJokepu wrote: post #9
juliano_q wrote: post #4

I don't know how is possible that a so obvious bug passed their quality department, and I wonder if someone didnt discovered it before and was doing this to take out competitors indexes..

Bugs happen. Even big ones like this. Any engineer worth his money knows that no amount of Q&A will discover 100% of the bugs. But, as Joel Spolsky said somewhere, bugs are just bugs, you fix them and then they're fixed.

I know, I am an engineer and I obviously let bugs pass too. But this is a little too obvious to me, to check if the user is allowed to remove this url. Maybe I am neurotic? :)

Re: Remove any Site From Google (even if you don't control it)

#13

Post by _gingerhendrix »

brownie wrote: post #3

Despite it being "fixed" not long after the blog post went live, I wonder how long/how many people knew about this bug. Seems like it would be a great trick for SEO (build page to certain PR/remove opponents ranking above you)

What's a great trick for SEO is this sensationalist linkbait article.

Re: Remove any Site From Google (even if you don't control it)

#14

Post by trotsky »

juliano_q wrote: post #11
DrJokepu wrote: post #9

Earlier quoted context omitted.

Bugs happen. Even big ones like this. Any engineer worth his money knows that no amount of Q&A will discover 100% of the bugs. But, as Joel Spolsky said somewhere, bugs are just bugs, you fix them and then they're fixed.

I know, I am an engineer and I obviously let bugs pass too. But this is a little too obvious to me, to check if the user is allowed to remove this url. Maybe I am neurotic? :)

most bugs are obvious after someone has pointed them out to you.

Re: Remove any Site From Google (even if you don't control it)

#15

Post by michaelfairley »

wccrawford wrote: post #5

I think it's sad that he had to resort to publicly releasing this exploit because he couldn't find a way to contact Google about it. In the past, when I've had problems, I couldn't contact them either. They've done a great job at making sure there's no human contacts available. You have to post something in a public forum and hope they'll contact you. (They won't.)

I'm not sure how he was unable to find their security@google.com email address. Searches like "Google security" and "Google report vulnerability" have http://www.google.com/about/corporate/company/security.html (which has a prominent section on reporting security issues) as their first result.

Re: Remove any Site From Google (even if you don't control it)

#16

Post by flatline »

juliano_q wrote: post #4

I don't know how is possible that a so obvious bug passed their quality department, and I wonder if someone didnt discovered it before and was doing this to take out competitors indexes..

My guess would be that someone took an internal tool with few security requirements and rolled it straight to production. If that is the case, this is probably an excellent candidate for a security audit, there are almost certainly more issues if something this basic was not in place.

Re: Remove any Site From Google (even if you don't control it)

#17

Post by cooldeal »

[deleted] wrote: post #12
latch wrote: post #6

His first blog post...talk about setting high expectations.

[deleted]

The story goes:

The huge printing presses of a major Chicago newspaper began malfunctioning on the Saturday before Christmas, putting all the revenue for advertising that was to appear in the Sunday paper in jeopardy. None of the technicians could track down the problem. Finally, a frantic call was made to the retired printer who had worked with these presses for over 40 years. “We’ll pay anything; just come in and fix them,” he was told.

When he arrived, he walked around for a few minutes, surveying the presses; then he approached one of the control panels and opened it. He removed a dime from his pocket, turned a screw 1/4 of a turn, and said, “The presses will now work correctly.” After being profusely thanked, he was told to submit a bill for his work.

The bill arrived a few days later, for $10,000.00! Not wanting to pay such a huge amount for so little work, the printer was told to please itemize his charges, with the hope that he would reduce the amount once he had to identify his services. The revised bill arrived: $1.00 for turning the screw; $9,999.00 for knowing which screw to turn.

Re: Remove any Site From Google (even if you don't control it)

#18

Post by dangrossman »

juliano_q wrote: post #11
DrJokepu wrote: post #9

Earlier quoted context omitted.

Bugs happen. Even big ones like this. Any engineer worth his money knows that no amount of Q&A will discover 100% of the bugs. But, as Joel Spolsky said somewhere, bugs are just bugs, you fix them and then they're fixed.

I know, I am an engineer and I obviously let bugs pass too. But this is a little too obvious to me, to check if the user is allowed to remove this url. Maybe I am neurotic? :)

I can see having this pass by a reviewer or two. They look and see all of this:

- There are permission checks

- The user has to be logged in to GWT

- The user has to have access to this page

- The user has to be the owner of the siteUrl

After all those permission checks, it might appear that everything was covered. It's just one little omission, verifying that the urlt parameter corresponds to a page within the siteUrl website, that was missed.

Re: Remove any Site From Google (even if you don't control it)

#19

Post by cooldeal »

trotsky wrote: post #14
juliano_q wrote: post #11

Earlier quoted context omitted.

I know, I am an engineer and I obviously let bugs pass too. But this is a little too obvious to me, to check if the user is allowed to remove this url. Maybe I am neurotic? :)

most bugs are obvious after someone has pointed them out to you.

I think the point is that it's a basic dev and QA fail not to check for this, especially with people of the caliber that Google is supposed to recruit.

Re: Remove any Site From Google (even if you don't control it)

#20

Post by drivebyacct2 »

wccrawford wrote: post #5

I think it's sad that he had to resort to publicly releasing this exploit because he couldn't find a way to contact Google about it. In the past, when I've had problems, I couldn't contact them either. They've done a great job at making sure there's no human contacts available. You have to post something in a public forum and hope they'll contact you. (They won't.)

It's obnoxious how hard it is to report bugs to Google. And posting in their forum is a joke anyway. Google's new two-factor authentication? Really neat right? Yeah, well, it's buggy and there is no way to report bugs for it. I posted in the forum and was received by crickets.

I don't mind it most of the time, but when I have a real issue or something that is obviously broken and unnoticed, it sure is frustrating.

edit: There's also no category for "generic login problems" or "Other". So I'm stuck posting it in Gmail.

Post reply on HN