4 ms·

Okay, you can disagree, but the word "serious" only works comparatively. If every vulnerability is "serious", then none of them are, and the word loses its mea

by dsacco 10y ago

Okay, you can disagree, but the word "serious" only works comparatively. If every vulnerability is "serious", then none of them are, and the word loses its meaning and people stop responding to it. If not every vulnerability is "serious" but open redirection is, what do you call something like command injection or SQL injection? "Double-plus serious"? I understand that developers need to take security seriously, but that effort is undermined by being hyperbolic about vulnerability severity. No one is trying to say open redirection isn't a vulnerability, it's just not all that...well, serious. Fix it, but it's not a hair on fire problem.

ebbv 10y ago
I would call any easily corrected behavior of your site that could lead a normal innocent user to being compromised is a serious vulnerability. Your statement implies there's an unlimited number of these but there aren't. SQL injection is worse than open direction, but storing your passwords and CC data in plaintext and leaving your root account SSH-able on port 22 with no password is worse than SQL injection. Just because there's something worse than X doesn't mean X is not bad. The important thing here is open redirection is a stupid, optional behavior and there's no good reason for it. It shouldn't be there. Allowing it is just as stupid as allowing XSS. It's just lazy and sloppy and frankly inexcusable for a company like Google, which should be held to a much higher standard than a mom and pop web store that sells cat figurines.
- dsacco 10y ago
  >> I would call any easily corrected behavior of your site that could lead a normal innocent user to being compromised is a serious vulnerability. So your stance is the first option, that basically any security vulnerability is serious. The grand majority of vulnerabilities are much simpler to fix than they are to find; once you find them, fixing them is generally straightforward. Given that we are using fundamentally different and incompatible definitions of the word "serious", we are obviously going to continue to disagree on this point. Perhaps it would help if I reframe this for you - there are vulnerabilities which warrant an on-call engineer being woken up at 4 am, and there are those which do not. Further, there are vulnerabilities which need to be fixed this week and those which can wait until the next feature release. If you don't like my use of the word "serious", hopefully you'll find that more agreeable. I don't think we are arguing over the same point anymore. You continue on to attack Google for having this vulnerability, but I don't think you have spent much time doing vulnerability research if you react that way about a company of Google's size. The sheer codebase alone basically guarantees every type of vulnerability will be found. Furthermore, being antagonistic about it in the way that you are is not conducive to recognition or remediation. Attempting to shame companies or engineering teams is counterproductive to developer awareness and education. At the end of the day, this is just a specialization and your job is not to be mean to them for making mistakes, it's to try to improve their understanding and help them resolve the issue while avoiding it in the future.
Twisell 10y ago
Thank you since 5 years now I kept myself out of Google SSO as much is I could and carefully use a bug tracker outside my favorites sites because I don't trust Google for privacy matter. Sometimes I wonder if I'm too much paranoid, but your carelessness just prove me right and I will keep NOT trusting your company.
- deleted 10y ago
  [deleted]
- jsmthrowaway 10y ago
  Er, who do you think works for Google here?
dfc 10y ago
I apoligize I don't have my copy of Garner in front of me. Why are you saying serious is only used comparatively?

by dsacco 10y ago

ebbv 10y ago

I would call any easily corrected behavior of your site that could lead a normal innocent user to being compromised is a serious vulnerability. Your statement implies there's an unlimited number of these but there aren't. SQL injection is worse than open direction, but storing your passwords and CC data in plaintext and leaving your root account SSH-able on port 22 with no password is worse than SQL injection. Just because there's something worse than X doesn't mean X is not bad. The important thing here is open redirection is a stupid, optional behavior and there's no good reason for it. It shouldn't be there. Allowing it is just as stupid as allowing XSS. It's just lazy and sloppy and frankly inexcusable for a company like Google, which should be held to a much higher standard than a mom and pop web store that sells cat figurines.

dsacco 10y ago
>> I would call any easily corrected behavior of your site that could lead a normal innocent user to being compromised is a serious vulnerability. So your stance is the first option, that basically any security vulnerability is serious. The grand majority of vulnerabilities are much simpler to fix than they are to find; once you find them, fixing them is generally straightforward. Given that we are using fundamentally different and incompatible definitions of the word "serious", we are obviously going to continue to disagree on this point. Perhaps it would help if I reframe this for you - there are vulnerabilities which warrant an on-call engineer being woken up at 4 am, and there are those which do not. Further, there are vulnerabilities which need to be fixed this week and those which can wait until the next feature release. If you don't like my use of the word "serious", hopefully you'll find that more agreeable. I don't think we are arguing over the same point anymore. You continue on to attack Google for having this vulnerability, but I don't think you have spent much time doing vulnerability research if you react that way about a company of Google's size. The sheer codebase alone basically guarantees every type of vulnerability will be found. Furthermore, being antagonistic about it in the way that you are is not conducive to recognition or remediation. Attempting to shame companies or engineering teams is counterproductive to developer awareness and education. At the end of the day, this is just a specialization and your job is not to be mean to them for making mistakes, it's to try to improve their understanding and help them resolve the issue while avoiding it in the future.

Twisell 10y ago

Thank you since 5 years now I kept myself out of Google SSO as much is I could and carefully use a bug tracker outside my favorites sites because I don't trust Google for privacy matter. Sometimes I wonder if I'm too much paranoid, but your carelessness just prove me right and I will keep NOT trusting your company.

deleted 10y ago
[deleted]
jsmthrowaway 10y ago
Er, who do you think works for Google here?

dfc 10y ago

I apoligize I don't have my copy of Garner in front of me. Why are you saying serious is only used comparatively?