Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remove any Site From Google (even if you don't control it)

jamesbreckenridge.co.uk

Post reply on HN
Print view View original

51–60 of 102 posts

Re: Remove any Site From Google (even if you don't control it)

#51

Post by nbpoole »

sirn wrote: post #49
michaelfairley wrote: post #15

Earlier quoted context omitted.

I'm not sure how he was unable to find their security@google.com email address. Searches like "Google security" and "Google report vulnerability" have http://www.google.com/about/corporate/company/security.html (which has a prominent section on reporting security issues) as their first result.

Because now you know the email is spelled "security@google.com", it would be easy to come up with search query that returns that email address after the fact. If you going by the instinct, search for "google bug report", ...I'm on page 20 and still couldn't find that email. (Personalize search turned off.)

Because the security email address is not a place for bug reports: it shouldn't be ranking for that query. If it did, the team would just be swamped with "bug reports" ;)

Try searching for "google report security" or "security vulnerability google" and you'll find the right information.

Re: Remove any Site From Google (even if you don't control it)

#52

Post by fhars »

cheez wrote: post #34
staunch wrote: post #24

This bug could have been exploited for millions of dollars. Imagine giving a mafia boss control over the heartbeat of every rival. One blackhat SEO could have dominated any number of lucrative keywords. If this bug has existed for a long time it's quite possible some guy is sailing around on a yacht that this bug paid for. It's such a blindingly obvious bug that I really do wonder whether this might have been a backd…

> This bug could have been exploited for millions of dollars. Quite possibly exploited for non-savvy website owners. Savvy owners would be checking their ranking regularly and noticing it disappear one day. Anyone who ranks highly for lucrative keywords and does not check their ranking is asking to lose it, whether ethically or otherwise. So I don't think it would have been exploited for the millions you think, but p…

Then just run your attack on the day of a big algorithm or index update when it will be drowned by the usual "google made my children starve" noise.

Re: Remove any Site From Google (even if you don't control it)

#53

Post by nl »

_mvuc wrote: post #50
nl wrote: post #45

Earlier quoted context omitted.

He included screenshots and a description. Neither are impossible to fake, but either it's a genuine mistake (in which case I would imagine someone would have pointed it out) or he's faking it. You seem to be accusing him of faking, without any evidence or even a motive. Edit: also http://www.jamesbreckenridge.co.uk/what-i-learned-today.html

Was it the "I'm not saying it's fake" part that made it seem to you that I seem to be accusing him of faking? My point is that the evidence is wholly insufficient. It was the first post on a new blog (i.e. no reputation), no way to reproduce the reported issue, no reports of it having been reproduced by anyone else, no acknowledgment from Google (ok, maybe it's a little early for that), etc. I mean, from a journalist…

I think there were multiple reasons you were being downvoted:

1) The grandparent to your post accused the post of being linkbait, without explaining it in anyway. You appeared to be supporting this without any evidence that it was linkbait.

2) You took the discussion about it being linkbait, and introduced the accusation that the post was faked (not withstanding your "I'm not saying it is fake thing" - if you aren't saying that, then what are you saying?), which was totally unrelated to the thread of conversation.

3) You didn't provide any justification that it was fake - merely circumstantial evidence that doesn't preclude that it could be fake. It is pretty normal for someone to expose an exploit without independent verification - especially since it appears the author hadn't considered it a security hole (note the article doesn't mention security, and they didn't find the security@google.com email address which is pretty obvious if you are using the term "security" when you search).

Given these factors, I think the downvotes were justified.

I don't think there is anything wrong with being suspicious, but I think your post would have been better received if it had presented your suspicions differently.

Re: Remove any Site From Google (even if you don't control it)

#54

Post by michaelfairley »

sirn wrote: post #49
michaelfairley wrote: post #15

Earlier quoted context omitted.

I'm not sure how he was unable to find their security@google.com email address. Searches like "Google security" and "Google report vulnerability" have http://www.google.com/about/corporate/company/security.html (which has a prominent section on reporting security issues) as their first result.

Because now you know the email is spelled "security@google.com", it would be easy to come up with search query that returns that email address after the fact. If you going by the instinct, search for "google bug report", ...I'm on page 20 and still couldn't find that email. (Personalize search turned off.)

Any company worth its weight that stands to lose big time from a security vulnerability will have a page with info on how to report it to them, and searching "[company name] security" will usually get you right to it. Disclosure is what you do after you've contacted them and not heard back.

http://www.apple.com/support/security/

http://www.microsoft.com/security/msrc/report.aspx

https://www.dropbox.com/terms/#security

http://www.amazon.com/gp/help/customer/display.html/ref=hp_l...

Re: Remove any Site From Google (even if you don't control it)

#55

Post by _mvuc »

nl wrote: post #45
[deleted] wrote: post #36

Earlier quoted context omitted.

[deleted]

He included screenshots and a description. Neither are impossible to fake, but either it's a genuine mistake (in which case I would imagine someone would have pointed it out) or he's faking it. You seem to be accusing him of faking, without any evidence or even a motive. Edit: also http://www.jamesbreckenridge.co.uk/what-i-learned-today.html

Also, what is the link you supplied supposed to show? To me, it's like someone who, hearing the accuracy of Genesis' creation story challenged due to lack of supporting evidence, replies, "Yes, but Exodus says the same thing." It's the same source making the same claim, with no corroboration.

You imagine that someone would have pointed out an honest mistake, but that could take time. Is absence of an immediate counter-demonstration proof (or even evidence) of truth? I don't think it works that way. See Fleischmann–Pons.

Re: Remove any Site From Google (even if you don't control it)

#57

Post by nl »

_mvuc wrote: post #55
nl wrote: post #45

Earlier quoted context omitted.

He included screenshots and a description. Neither are impossible to fake, but either it's a genuine mistake (in which case I would imagine someone would have pointed it out) or he's faking it. You seem to be accusing him of faking, without any evidence or even a motive. Edit: also http://www.jamesbreckenridge.co.uk/what-i-learned-today.html

Also, what is the link you supplied supposed to show? To me, it's like someone who, hearing the accuracy of Genesis' creation story challenged due to lack of supporting evidence, replies, "Yes, but Exodus says the same thing." It's the same source making the same claim, with no corroboration. You imagine that someone would have pointed out an honest mistake, but that could take time. Is absence of an immediate counte…

I understand your point, but this is different to Fleischmann–Pons because of Google's capacity to change things.

In any case, http://searchengineland.com/google-disables-url-removals-aft... appears to indicate that Google has disabled the tool and are investigating. That indicates to me that it isn't totally fake at least. Maybe it only happens in some circumstances, or maybe there is some other explanation, but I doubt Google would disable the tool completely if what he claimed didn't have some basis.

Re: Remove any Site From Google (even if you don't control it)

#58

Post by sidman »

spooneybarger wrote: post #44
drivebyacct2 wrote: post #20

Earlier quoted context omitted.

It's obnoxious how hard it is to report bugs to Google. And posting in their forum is a joke anyway. Google's new two-factor authentication? Really neat right? Yeah, well, it's buggy and there is no way to report bugs for it. I posted in the forum and was received by crickets. I don't mind it most of the time, but when I have a real issue or something that is obviously broken and unnoticed, it sure is frustrating. ed…

My favorite has always been the google apps problems that tell you to contact support to get a resolution but you can only contact support if you are a paying customer. support is not google's strong suit.

I am a google apps paying customer and it took them 4 weeks to get my domain issue corrected ! In that time i wasnt able to get mail so i had to change my mail to use godaddy until they got back to me. When they finally did they said it was because my dns records were pointing to godaddy ! After 1 week of not getting mails i would say an alternative is required. I actually had a feeling that this would happen :)

I really love google as a company, their products, api's, their talks and all the events they hold are so great, i have learnt alot, BUT man, when i couldn't access my mail as a paying customer and got the runaround for support for 4 weeks even though they said it was high on the priority list ... GRRR thinking about it just makes me mad.

Anyway on a good note, after this issue everything is working fine and i guess aslong as you dont need support then everything is good :)

Re: Remove any Site From Google (even if you don't control it)

#59

Post by _mvuc »

nl wrote: post #53
_mvuc wrote: post #50

Earlier quoted context omitted.

Was it the "I'm not saying it's fake" part that made it seem to you that I seem to be accusing him of faking? My point is that the evidence is wholly insufficient. It was the first post on a new blog (i.e. no reputation), no way to reproduce the reported issue, no reports of it having been reproduced by anyone else, no acknowledgment from Google (ok, maybe it's a little early for that), etc. I mean, from a journalist…

I think there were multiple reasons you were being downvoted: 1) The grandparent to your post accused the post of being linkbait, without explaining it in anyway. You appeared to be supporting this without any evidence that it was linkbait. 2) You took the discussion about it being linkbait, and introduced the accusation that the post was faked (not withstanding your "I'm not saying it is fake thing" - if you aren't…

I'll admit that the quotes around "screenshots" exposed a bias (though I privately considered "honest mistake" a real contender), so I'll take my lumps.

But I stand by my main point: I don't see any REASON to BELIEVE.* The only thing separating malice, incompetence and good work here are the unknown motives of some guy with an internet connection -- possibly an NYU student of Panos Ipeirotis, if you caught that story. I think it was fair to ask why people felt so confident with their "OMG! Google is incompetent!" posts, so quickly. I guess I picked the wrong grandparent.

* You've kindly provided a corroborating source, so "good work" is looking more likely.

Re: Remove any Site From Google (even if you don't control it)

#60

Post by bostonvaulter2 »

pbz wrote: post #42

Somewhat related: I wish GWT had a "pattern" removal. With one of my sites, by the time I noticed that certain pages were missing the "noindex" tag Google happily indexed over 4000 pages. Considering the rate Google is crawling those pages it may take years to be removed from the index. Obviously, submitting each link one by one is rather tedious. Hopefully the author is going to release that extension after Google f…

Grrr, google and it's acronym's, I thought GWT stood for Google Web Toolkit and I was really confused for a second. Instead this GWT stands for Google Webmaster Tools...
Post reply on HN