6 ms·

Someone left my Gmail in debug mode

285 points by zatkin 11y ago

nishantmodak 11y ago
I can see this in my inbox too!
J_Darnley 11y ago
Be careful you done get done for hacking.
deleted 11y ago
[deleted]
- zerocrates 11y ago
  "Spy" is a fairly common name for profilers and testing/analysis utilities, like Visual Studio's Spy++.
  - Stratoscope 11y ago
    I missed the now-deleted message you replied to, but if it was objecting to the term "Spy", that may be partly my fault. I wrote a Windows program called Spy back in 1987 for a BYTE Magazine article. Spy++ was inspired by this program, and true to its name, Spy++ was much better! Here's some old-school Windows programming, along with great ads for the hot computer products of the day: https://archive.org/stream/byte-magazine-1987-12/1987_12_BYTE_12-14_AT_Memory_Boards_and_Naturla_Language_Processing#page/n101/mode/2up https://archive.org/stream/byte-magazine-1987-12/1987_12_BYT...
    - maaarghk 11y ago
      Oh wow, you weren't kidding when you said old-school! Some of the adverts in there are great too :)
  - deleted 11y ago
    [deleted]
umanwizard 11y ago
Releasing this code that was obviously not intended to ever be public rubs me the wrong way a bit -- not to mention, it's probably illegal. Edit: "publicizing", not "releasing". As others pointed out, the website doesn't contain any actual code.
- shakethemonkey 11y ago
  Calling screenshots "code" might be a bit much. This isn't in any way illegal, as it barely qualifies as a creative work.
  - morninj 11y ago
    OK, though plenty of illegality is not very creative.
- Archio 11y ago
  > it's probably illegal I certainly, certainly hope not. While of course there is an ethical question involved here, making it illegal to release "code that was obviously not intended to be public" is a MASSIVE slippery slope. I could put your grandmother in jail for clicking a broken link in her email and sharing the confusing things she saw, because of a "bug" in my app.
  - deleted 11y ago
    [deleted]
  - TheDong 11y ago
    It definitely has a good chance at being illegal. So does your grandmother clicking a link in the email if she has any hint of an idea that she's not supposed to click that link (e.g. if the email said "you are not permitted to access this link" it suddenly could be illegal to intentionally visit it). It's called the "Computer Fraud and Abuse Act"[0]. The exact portion is: "Whoever intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains information from any protected computer" is guilty of a criminal offence. This user of Gmail obviously surmised this was debug information he was not meant to see. As soon as he clicked that debug link or the detail link, he was intentionally accessing information without authorized access. He knew he was not supposed to access that information and he did so anyways. The CFAA has been used before for things not too far off for this. 3Tap[1] was found guilty of CFAA abuse when it scraped Craigslist after its IPs were banned. Weev[2] was prosecuted under the CFAA for accessing unprotected AT&T customer data that was hidden behind a url with an incrementing integer ID (no password, no username, just a perl script to increment a url parameter in a get request). This is a fairly well documented law that has been used a number of times and it's almost certain that the author is guilty under it, as written. It's one hell of a broad law. [0]: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act [1]: https://en.wikipedia.org/wiki/Craigslist_Inc._v._3Taps_Inc https://en.wikipedia.org/wiki/Craigslist_Inc._v._3Taps_Inc. [2]: https://www.eff.org/deeplinks/2013/07/weevs-case-flawed-beginning-end https://www.eff.org/deeplinks/2013/07/weevs-case-flawed-begi...
defenestration 11y ago
An icon of a skull with bones was used for the debugger. That, in combination with the 'Spy' components, is giving users an eerie feeling. Note to myself: don't be funny in debugmode
- rdtsc 11y ago
  Yeah being cute in error or debug messages doesn't work as intended sometimes. I've seen uncomfortable moments when customers called after experiencing downtime / data loss and were reading back logs that contained cute and snarky terminology.
  - spb 11y ago
    > Remember: your "funny" documentation is going to seem a hell of a lot less funny when the functionality it's joking about isn't working. https://twitter.com/stuartpb/status/508235714287259648 https://twitter.com/stuartpb/status/508235714287259648
- dbalan 11y ago
  If you are building debug interfaces in the app instance, makes sense to design the wording as the end customer would see it. We'll make mistakes, its better to be proactive. (another eg: vine shipping iOS apps with debug enabled)
- cookiecaper 11y ago
  Yes. You should always assume that your test and debug strings will leak some day, because they probably will. As boring as it gets, they should at least be professional.
- yongjik 11y ago
  Eh, you're talking about a company that once named its ad serving system SmartASS. You can be professional and have fun at the same time. (Or at least most Google engineers believe so.)
  - rasz_pl 11y ago
courtneypowell 11y ago
I experienced the same issue today. Entire screen was blank with the exception of the page header. I was only able to access my mail in an incognito browser.
nodesocket 11y ago
I'm guessing just one or a small number of servers were in debug mode by accident, thus like winning the lottery that your request hits a debug server.
sauere 11y ago
I experienced the exact same issue on a paid Google Apps for Business account yesterday evening around 11pm CET. Creeped me out, i assumed it was some Browser Plugin gone rouge.
- tajen 11y ago
  Did you deactivate all your browser plugins since? I activate them on demand and keep them off most of the time (especially browser screenshot tools and syntax coloration of json).
- WCityMike 11y ago
  You never know, a little mascara and rouge can make those Browser Plugins look really nice.
tedchs 11y ago
FYI this is a known issue: https://support.google.com/a/answer/6166309?hl=en https://support.google.com/a/answer/6166309?hl=en

285 points by zatkin 11y ago

nishantmodak 11y ago

I can see this in my inbox too!

J_Darnley 11y ago

Be careful you done get done for hacking.

deleted 11y ago

[deleted]

zerocrates 11y ago
"Spy" is a fairly common name for profilers and testing/analysis utilities, like Visual Studio's Spy++.
- Stratoscope 11y ago
  I missed the now-deleted message you replied to, but if it was objecting to the term "Spy", that may be partly my fault. I wrote a Windows program called Spy back in 1987 for a BYTE Magazine article. Spy++ was inspired by this program, and true to its name, Spy++ was much better! Here's some old-school Windows programming, along with great ads for the hot computer products of the day: https://archive.org/stream/byte-magazine-1987-12/1987_12_BYTE_12-14_AT_Memory_Boards_and_Naturla_Language_Processing#page/n101/mode/2up https://archive.org/stream/byte-magazine-1987-12/1987_12_BYT...
  - maaarghk 11y ago
    Oh wow, you weren't kidding when you said old-school! Some of the adverts in there are great too :)
- deleted 11y ago
  [deleted]

umanwizard 11y ago

Releasing this code that was obviously not intended to ever be public rubs me the wrong way a bit -- not to mention, it's probably illegal. Edit: "publicizing", not "releasing". As others pointed out, the website doesn't contain any actual code.

shakethemonkey 11y ago
Calling screenshots "code" might be a bit much. This isn't in any way illegal, as it barely qualifies as a creative work.
- morninj 11y ago
  OK, though plenty of illegality is not very creative.
Archio 11y ago
> it's probably illegal I certainly, certainly hope not. While of course there is an ethical question involved here, making it illegal to release "code that was obviously not intended to be public" is a MASSIVE slippery slope. I could put your grandmother in jail for clicking a broken link in her email and sharing the confusing things she saw, because of a "bug" in my app.
- deleted 11y ago
  [deleted]
- TheDong 11y ago
  It definitely has a good chance at being illegal. So does your grandmother clicking a link in the email if she has any hint of an idea that she's not supposed to click that link (e.g. if the email said "you are not permitted to access this link" it suddenly could be illegal to intentionally visit it). It's called the "Computer Fraud and Abuse Act"[0]. The exact portion is: "Whoever intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains information from any protected computer" is guilty of a criminal offence. This user of Gmail obviously surmised this was debug information he was not meant to see. As soon as he clicked that debug link or the detail link, he was intentionally accessing information without authorized access. He knew he was not supposed to access that information and he did so anyways. The CFAA has been used before for things not too far off for this. 3Tap[1] was found guilty of CFAA abuse when it scraped Craigslist after its IPs were banned. Weev[2] was prosecuted under the CFAA for accessing unprotected AT&T customer data that was hidden behind a url with an incrementing integer ID (no password, no username, just a perl script to increment a url parameter in a get request). This is a fairly well documented law that has been used a number of times and it's almost certain that the author is guilty under it, as written. It's one hell of a broad law. [0]: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act [1]: https://en.wikipedia.org/wiki/Craigslist_Inc._v._3Taps_Inc https://en.wikipedia.org/wiki/Craigslist_Inc._v._3Taps_Inc. [2]: https://www.eff.org/deeplinks/2013/07/weevs-case-flawed-beginning-end https://www.eff.org/deeplinks/2013/07/weevs-case-flawed-begi...

defenestration 11y ago

An icon of a skull with bones was used for the debugger. That, in combination with the 'Spy' components, is giving users an eerie feeling. Note to myself: don't be funny in debugmode

rdtsc 11y ago
Yeah being cute in error or debug messages doesn't work as intended sometimes. I've seen uncomfortable moments when customers called after experiencing downtime / data loss and were reading back logs that contained cute and snarky terminology.
- spb 11y ago
  > Remember: your "funny" documentation is going to seem a hell of a lot less funny when the functionality it's joking about isn't working. https://twitter.com/stuartpb/status/508235714287259648 https://twitter.com/stuartpb/status/508235714287259648
dbalan 11y ago
If you are building debug interfaces in the app instance, makes sense to design the wording as the end customer would see it. We'll make mistakes, its better to be proactive. (another eg: vine shipping iOS apps with debug enabled)
cookiecaper 11y ago
Yes. You should always assume that your test and debug strings will leak some day, because they probably will. As boring as it gets, they should at least be professional.
yongjik 11y ago
Eh, you're talking about a company that once named its ad serving system SmartASS. You can be professional and have fun at the same time. (Or at least most Google engineers believe so.)
- rasz_pl 11y ago

courtneypowell 11y ago

I experienced the same issue today. Entire screen was blank with the exception of the page header. I was only able to access my mail in an incognito browser.

nodesocket 11y ago

I'm guessing just one or a small number of servers were in debug mode by accident, thus like winning the lottery that your request hits a debug server.

sauere 11y ago

I experienced the exact same issue on a paid Google Apps for Business account yesterday evening around 11pm CET. Creeped me out, i assumed it was some Browser Plugin gone rouge.

tajen 11y ago
Did you deactivate all your browser plugins since? I activate them on demand and keep them off most of the time (especially browser screenshot tools and syntax coloration of json).
WCityMike 11y ago
You never know, a little mascara and rouge can make those Browser Plugins look really nice.

tedchs 11y ago

FYI this is a known issue: https://support.google.com/a/answer/6166309?hl=en https://support.google.com/a/answer/6166309?hl=en