Live data from Hacker News

How we got read access on Google’s production servers

blog.detectify.com

171–180 of 197 posts

Re: How we got read access on Google’s production servers

#171
post #83

The guys behind this report have an interesting pricing model: Pay what you want! https://detectify.com/pricing The pricing models has apparently worked so far. Are any active users of Detectify here and can share their experience?

I like the price but they found nothing, honestly, and we're not very nice when I emailed them for support.

Just wanted to point out the hilarity of your typo: "we're not very nice when..." vs "were not very nice when..." completely reversed what you meant to say ;P.

Re: How we got read access on Google’s production servers

#172
post #69

Earlier quoted context omitted.

Sure, but didn't YAML in Rails do mostly the same type of thing? It's not just XML that is dumb like this.

YAML and XML seem too powerful and too complex for their own common use cases (data storage). Markdown too - how many Markdown parsers allow for strict parsing against an HTML whitelist, and don't allow native HTML at all by default?

I've never even thought of that. Wow. Obvious now of course.

Re: How we got read access on Google’s production servers

#173

Earlier quoted context omitted.

Hmm a pretty cheap road trip for just ten dollars, and I'm also not sure why they thought it necessary to include an extra significant figure for cents.

Some countries reverse the role of period and comma in numbers. The author meant ten thousand.

I'll admit, it threw me off at first too.

Re: How we got read access on Google’s production servers

#174
post #69

Earlier quoted context omitted.

YAML and XML seem too powerful and too complex for their own common use cases (data storage). Markdown too - how many Markdown parsers allow for strict parsing against an HTML whitelist, and don't allow native HTML at all by default?

I've never even thought of that. Wow. Obvious now of course.

http://www.youtube.com/watch?v=dnLYoMIBhpo

Re: How we got read access on Google’s production servers

#175
post #165

Earlier quoted context omitted.

So you pay money to hire somebody to send a company a letter informing the company of the companies problem in hopes that maybe, just maybe, the company will reward the the firm a small sum of money and you will get a small amount back. I think you have a winner on your hands.

They wouldn't be doing it for the money. The EFF would be a good example of a firm that could take this practice up.

That's besides the point. It still costs money, and the company that's vulnerable is not the one paying it. A service like this would be time consuming (bogus reports, etc), and the EFF would still have to use money from donations to finance this.

The only thing I can think about is some security firm doing this, using the exposure as a marketing tool and establish them as an authority on the subject.

Re: How we got read access on Google’s production servers

#177
post #63

Earlier quoted context omitted.

With the kind of monitoring that Google has in place your access will last a very short time.

What kind of monitoring would you deploy that would raise an alert for a process opening and reading readable files?

SELinux. This kind of stuff would be where it really shines. A correctly configured installation would block and report access to files the application is not supposed to access. Maintaining it, especially for individual applications, is work, but it seems to me that on the scale of Google it may well be worthwhile.

Re: How we got read access on Google’s production servers

#178
post #111
post #81

Earlier quoted context omitted.

XML made it for more manageable to create machine to machine API's. I can say we surely would not want go back to the 80's and 90's when dong that stuff was a nightmare.

Yes, it was a drunken, stumbling step forward. Let's take another one, and move to something simpler, which solves the problem better. To quote Phil Wadler's paper about XML, where he established some of the principles that influenced Xquery: "So the essence of XML is this: the problem it solves is not hard, and it does not solve the problem well."[1] I suggest reading the entire paper; It shows a number of shortcomi…

How about protocol buffers?

Re: How we got read access on Google’s production servers

#179
post #2

... And this is why you want to discontinue products and services your engineers can't be motivated to maintain. Amazing. This should scare anyone who has ever left an old side project running; I could see a lot of companies doing a product/service portfolio review based on this as a case study.

Or just move it to some cheap VPS where it cannot damage other services or your infrastructure.

Shouldn't they be there in the first place?

Even better, host on your competitor's servers.

Re: How we got read access on Google’s production servers

#180
post #170

Earlier quoted context omitted.

Oh -- that video was part of Googles response? I thought it was part some meme to describe Googles response.

That's how I read it, yes.

Meme is a common way of communication in Google, even formally.
Post reply on HN